4 ms·
Show HN: A real-time alert system for cam models – security review welcome
Hi HN - I built ReadyLive, a real-time monitoring + notification system for live cam models.
The basic idea: people often sit in rooms waiting for specific moments (private mode, ticket shows, certain goals, certain phrases). ReadyLive watches the rooms and alerts you when your triggers happen, so you don’t have to wait around.
What I’m most focused on right now isn’t growth or features, it’s privacy and security.
Privacy-first by design
I intentionally built this so it’s usable without giving up personal data:
• no ads, no tracking, no analytics tied to users
• you don’t need a real email (fake emails work fine)
• no viewing history, no behavioral profiles
• as little stored data as possible (the goal is: even if someone got the DB, there’s not much to learn)
I’m not looking for a full audit or free work, more like: what obvious security problems am I missing?
If you were threat-modeling something like this:
• where do privacy leaks usually happen in systems like this, even when you try to avoid storing data?
• any common gotchas with letting users define triggers (even with strict limits)?
• does using Telegram for notifications change the threat model in ways people often underestimate?
• what would you try to break first?
I’m trying to sanity-check the boundaries early, before complexity creeps in.
Link: https://readylive.io https://readylive.io
Happy to answer any questions or share details if that helps.
- mayflowjay 9mo agoIf it helps focus the discussion: the things I’m most unsure about are (1) how privacy leaks happen even when you store very little, and (2) whether Telegram introduces risks I’m underestimating. If you’ve built alerting systems or privacy-minimal services, I’d love to hear what you’d try to break first.
- roscas 9mo agoMy two cents, if you use storage.googleapis.com privacy is zero. You are just telling Google what you are doing. No need for that, right? Out of curiosity what is jwnozfjzczoufsdzwfvd.supabase.co for?
- mayflowjay 9mo agoI appreciate that :) Thanks for replying. Those storage.googleapis.com URLs are just Supabase Storage (it sits on Google Cloud Storage). I’m not using it for anything user related or anything like that, it’s mostly static stuff + app data. Not sure how to get around that, unless I host everything myself, which I dont have the capacity to do. jwnozfjzczoufsdzwfvd.supabase.co is just the Supabase project endpoint (db/auth/storage).
- roscas 9mo agoFair. But most of the times scripts can be downloaded and integrated on the webpage. Don't know if that is the case but many can.