How OSCAR keeps your installation safe

The short version

• Nothing at your venue is opened to the internet. OSCAR connects out, the way a browser does. No port is forwarded, no router is touched.
• A phone can say one thing: this control, this state. It has nowhere to put an address, a port or a channel.
• OSCAR decides what happens, not the phone. It only acts on controls you published, within the range you set.
• Floods stop before they reach you. A bot check and rate limits run on the relay, far from your venue.
• Visitors are asked for nothing and nothing about them is kept.
• Make it private and the link stops working at once.

So the worst a visitor on the internet can do is what a visitor at the venue could do with their thumb.

Where the connections go

visitor's phone  -->  relay (Cloudflare)  <--  your OSCAR  -->  your software, gear and lights

When you make an interface public, your OSCAR opens a connection to our relay, a small service on Cloudflare's network. A visitor's phone opens a connection to the same relay. The two never connect to each other, and neither can reach your venue. Both connections are encrypted, like any website with a padlock.

The page a visitor opens is served from Cloudflare's network, not from your computer. A crowd loading the page never touches your venue's internet connection. When something changes, OSCAR tells the relay once and the relay copies it to every phone, so one message leaves your venue however big the crowd.

Close OSCAR, and the connection is gone. There is nothing left listening.

A phone can only say one thing

The relay is deliberately simple. A phone may send one kind of message: this control, this state. The message has no field for an OSC address, a port, a MIDI channel or a DMX universe. There is nothing to type one into, so nobody can.

The relay checks the shape of each message and how often it arrives, and passes it on. It does not know what a control is. OSCAR does. OSCAR looks the control up in the interface as you published it, holds the value to the range you gave it, and sends what you configured to the destination you configured.

• A control you did not publish cannot be reached. It does not exist to the phone.
• A fader that goes from 0 to 1 cannot be pushed to 100. The value is held to its range.
• A button sends the message you gave it, to the address you gave it, and no other.
• A message that does not fit the shape is ignored.

Any button, slider or pad on a public interface can do exactly what it does on a tablet in the room. Nothing more.

The link is the key

Every public interface has its own long, random address. There is no list to browse and no way to guess one. Anyone with the link can open the interface, so put it where you want it used: on the QR code beside the installation, on your event page, in a message to your crew.

A public page is public. Keep anything confidential off it, as you would with any web page you share.

To stop it, flip the Public switch in OSCAR, or make it private from the portal on any other computer. The page is removed from the relay at once, and phones that still have the link see that the installation is not public at the moment. Unpublishing the interface in OSCAR does the same. When you make it public again the same link comes back, so a printed QR code stays good.

Built for a crowd of strangers

A public link will be opened by people you have never met, and sometimes by scripts. The relay expects that, and holds the line before anything reaches your venue.

• A bot check. Before a phone may join, Cloudflare runs an invisible check that tells a person from a script. A phone that passes keeps a pass for twelve hours, the length of an evening, and is checked again tomorrow.
• A pace per phone. A phone may send about as fast as a finger can move a fader. Anything faster is dropped, never queued, so a fader shows where the finger is rather than where it was. A phone that keeps pushing past the limit is dropped from the room.
• A size per message. A control message is a few dozen bytes. Anything large is not a control message and is refused.
• A cap per room. Fifty phones can be on one interface at once. The fifty-first is told the room is full.
• A ceiling per day. A room that has passed on an unreasonable number of messages in one day pauses until midnight. A flood costs you nothing and reaches nobody.

All of this happens on Cloudflare's network. Your venue's connection, your computer and your software never see the traffic that was turned away.

What the relay keeps, and what it does not

• Visitors are asked for nothing. No account, no name, no email. There is no tracking and no analytics on a public page.
• What visitors do is passed on, not stored. The relay keeps a count of messages per interface, to enforce the limits above, and nothing about what they were.
• One cookie. The pass from the bot check, which says only that this phone got through, for twelve hours. It holds nothing about the visitor.
• The page is kept on the relay for as long as the interface is public, and removed when you make it private.
• Cloudflare sees IP addresses, to deliver the page and to block abuse, as any website's host does.

The privacy policy says the same in full.

Your account and your show

• No passwords. You sign in with Google, with Discord, or with a code sent to your email. OSCAR never sees a password and we never store one.
• Your plan is a signed file on your computer. OSCAR checks the signature offline, so it works with no internet. The relay checks the same signature before it lets an OSCAR host a room.
• A room belongs to the account that made it. Another account, even with the link, is refused as a host.
• A show that is running keeps running. A subscription that ends never stops an installation already on. Pro gates what is offered, not what is live.
• Payment never touches us. Paddle takes the payment and tells us only which account has Pro. We never see a card number.

On your own network, nothing leaves the building

Everything above is about public interfaces. Every other interface, and all of OSCAR without Pro, works on your own network with no internet at all. Phones and tablets on your Wi-Fi talk to your computer directly. Your projects are files on your computer. Nothing is sent to us.

For a show or an installation, press the padlock in OSCAR's toolbar. Everyone on the network can still use the interface, but nobody can edit it, save over it or delete it, except from the computer running OSCAR. Having your hands on that computer is what grants editing, so there is no password to leak over a venue's network or forget before doors open. OSCAR remembers the setting, so a machine that reboots overnight comes back locked.

Your local network is as safe as your Wi-Fi. Run a show on a network you control, with a password you chose.

The AI assistant stays on your computer

An AI assistant can connect to OSCAR only from the same computer, and only while you leave the MCP switch on. It can read your projects and the network log, and write a draft for you to open. It cannot send anything to your software, publish, or change a project. How it works has the details.

Open to inspection

OSCAR is open source. What it sends, what it receives and how it holds a value to its range is in the code on GitHub for anyone to read. The rules on this page are the rules the relay enforces today. If they change, this page changes.

Found something?

If you think you have found a weakness, write to hello@createwithoscar.site before telling anyone else. We will answer quickly, fix it, and tell you when it is done.