Security

Your host, your perimeter

MeetBot runs on a Mac you administer. Harden that machine: auto-login only for the bot account as needed, keep the OS patched off-hours, restrict who can reach the web UI, and treat data/secrets like production credentials.

Secrets on disk

• Google and Atlassian OAuth tokens live under data/secrets (mode 600 recommended)
• Chrome profile holds the bot’s Meet session — protect data/chrome-profile
• WEB_SESSION_SECRET signs UI cookies; rotate if leaked
• OpenRouter keys unlock transcription and the agent — store only in .env or settings

Web UI

• Google ID tokens are verified server-side before a session is issued
• Optional WEB_ALLOWED_DOMAIN limits sign-in to your company
• Prefer HTTPS (PUBLIC_URL) for any non-localhost access

Meeting content

Anyone with filesystem or UI access can play recordings and read transcripts. Limit OS users, network exposure, and UI allowlists accordingly. Inform participants according to your recording policy.

Reporting issues

Report security concerns via the MeetBot repository.