RVTik Stream Security
Security principles used by RVTik Stream for local data, TikTok connections, tokens, updates, and support.
Security layers that matter to users.
This page explains product security boundaries without publishing secrets or implementation details that would weaken the system.
1. Local data and app communication
RVTik Stream follows a local-first approach for configuration, presets, cache, media, and dashboard/overlay operation. Some functions still require internet access for TikTok LIVE services, license validation, updates, and online services selected by the user.
2. TikTok login and Dual Engine
Engine 1 / Standard does not require entering a TikTok password into the RVTik dashboard. Engine 2 / Browser Session uses a TikTok session inside a dedicated browser on the user's device. Auto can select or switch the active connection path when needed.
3. Tokens, private URLs, and secrets
License tokens, cookies, session IDs, private overlay URLs, authorization headers, API keys, and other secrets must not be published. Production logging also applies redaction to reduce accidental secret exposure in diagnostic logs.
4. Dashboard and local connection
The modern dashboard path is designed so license tokens do not need to travel in URLs. Origin/frame validation and local connection authentication are used where stronger boundaries are required between the renderer, dashboard, and main process.
5. Application updates
Use installers from official pages. Update metadata and release channels should be verified before installation. When a differential package cannot be verified, falling back to a full package is safer than using an invalid partial package.
6. Safe support
Do not send passwords, cookies, license tokens, API keys, or private URLs in support logs. If a secret is posted publicly, treat it as exposed and rotate or revoke it when possible.
7. Reporting a security issue
Send private reports to hello@rvtikstream.com or contact an administrator through RVTik Discord. Include the app version, reproduction steps, impact, and minimal proof without publishing exploits in public channels.