Processing boundary
Nosmai Effects performs camera effects processing on the device. The host application still controls camera permission, captured-media storage, recording, streaming, analytics, crash reports, and any network transfer of processed output. Document those host behaviors in the application's privacy notice and platform permission explanations.
License verification and Cloud Filters require Nosmai services. Do not describe the complete SDK as permanently offline when those features are enabled.
Protect license credentials
- Bind keys to the final platform and signed application identity.
- Inject a production key through private build or runtime configuration.
- Never commit a key, verification token, private package URL, or signed download URL.
- Redact credentials from logs, screenshots, support tickets, analytics, and crash metadata.
- Rotate a key after suspected exposure and remove it from repository history where possible.
- Do not rely on client obfuscation as the only access control. Server-side verification and app binding remain authoritative.
Mobile application binaries can be inspected. Treat an embedded app-bound key as a restricted client credential, not as an unrestricted server secret.
Handle effects safely
Apply only SDK-authorized .nosmai packages returned by the local catalog, official sample assets, or Cloud Filter download APIs. Preserve the returned local path unchanged. Do not unpack, edit, rename, mirror, or execute content from an untrusted package source.
The Web preview accepts browser sources such as URL, Blob, and typed arrays; apply an application allowlist, CSP, size limit, and authenticated delivery policy before passing untrusted network content to the preview loader.
Camera and media privacy
- Request camera, microphone, and photo-library access only when the relevant feature is used.
- Explain why each permission is needed before the operating-system prompt.
- Keep one camera owner and stop capture when the screen no longer needs it.
- Store recordings and photos according to the host application's retention policy.
- Avoid per-frame base64, image, or analytics payloads. Processed-frame APIs can expose biometric and environmental information to the host app.
- Confirm that a streaming provider's transport, region, recording, and access policy matches the application's privacy requirements.
Production logging
Public SDK logs should identify the operation and a stable error without printing private endpoints, authorization headers, complete keys, signed URLs, device tokens, protected package contents, or local user paths. Enable verbose diagnostics only for a bounded support session and review them before sharing.
Supply-chain checks
Verify Android and iOS release checksums before integration. Pin wrapper and native versions, inspect lockfiles, keep one native binary per target, and restrict release access to the official repositories and registries listed in the compatibility reference.
Incident checklist
- Revoke or rotate exposed credentials.
- Preserve a redacted timeline and affected release versions.
- Stop distribution of an unverified artifact or package.
- Rebuild from verified sources and confirm checksums.
- Test license, Cloud Filters, capture, recording, and streaming again.
- Notify affected project owners according to the applicable agreement and privacy policy.
