Security & compliance

Security & OWASP alignment

StreamWizard follows established security standards. This page summarizes which OWASP guidelines we align with and which technical controls we implement.

OWASP Top 10 (2025) OWASP ASVS v4.0.3 TLS 1.2+ / HSTS AES-GCM & SHA-256

Privacy Imprint Contact

English translation for convenience only. The German version is authoritative.

Short version:Security status: green StreamWizard is not formally certified by an external auditor, but its architecture and operations are consistently aligned with the OWASP Top 10 (2025) and recommendations from the OWASP Application Security Verification Standard (ASVS) v4.0.3. Vulnerabilities can be reported confidentially to support@streamwizard.de.

Security traffic light

Status: 28.07.2026

Public summary of the internal audit, mapped to OWASP Top 10 (2025) and OWASP ASVS v4.0.3 (Level 1 baseline, Level 2 for login/license/payment). No internal audit data or attack details.

Reference A02: Transport & browser protection

Green

TLS 1.2+, HSTS with preload, Content-Security-Policy with nonces, X-Frame-Options/Referrer-Policy/Permissions-Policy, no mixed content on public profiles.

Reference A07/A01: Login, sessions & CSRF

Green

OAuth (Discord/Twitch/Kick), HttpOnly/Secure/SameSite cookies, session rotation after login, CSRF tokens, rate limits against brute force.

Reference A05: Input handling & injection defense

Green

Prepared statements only (PDO), context-aware escaping (htmlspecialchars/ENT_QUOTES), strict validation at system boundaries, no string concatenation in queries.

Reference A04: Secrets & stored data

Green

AES-GCM for reversible values, SHA-256/HMAC-SHA-256 for lookups, rotatable keys, no secrets in code or logs, runtime pepper for sensitive operations.

Reference A01: Data export & account rights

Green

Role-based permissions (owner/delegate/admin), signed one-time tokens, user-readable data export plus technical JSON file, full account deletion available.

Reference A03: Dependencies & supply chain

Green

Vendored frontend libraries with Subresource Integrity (SRI) and a versioned vendor manifest with drift checks; continuous CVE scanning (OWASP dependency-check) and SBOM generation (CycloneDX) of the Java modules in CI, build fails at CVSS ≥ 7.

Reference A08: Release integrity & code signing

Green

JAR signing via YubiKey/PKCS#11, fail-closed runtime signature verification of the JAR before installation by the updater (pinned signer fingerprint), SHA-256 integrity header (Repr-Digest) on static downloads, signed one-time download links, verified Stripe webhook signatures, HMAC-signed API calls between Java and PHP.

Reference A09: Logging & alerting

Green

Security events are logged (login, API, downloads, SSRF blocks). IPs are anonymized to /24 (IPv4) or /64 (IPv6); sensitive values are not written to logs. Critical patterns (clustered auth failures, invalid OAuth states, CSP/SSRF spikes) auto-escalate via thresholds and alert – deduplicated and fail-open – through a Discord webhook and/or email.

Reference A01: SSRF & outbound calls

Green

Outbound requests only target hard-coded platform endpoints (Discord, Twitch, Kick, Stripe, YouTube). Fetches with creator-influenced image URLs pass through a central SSRF guard: https-only, DNS resolution blocking private/loopback/link-local/CGNAT targets, IP pinning against DNS rebinding, and revalidation of every redirect.

Reference ASVS L2: Payments & licensing path

Green

Stripe Checkout/Webhook with signature verification, separation of license and bot control data, fail-closed on license/auth errors, single-instance lock for enforcement.

Reference CSP: CSP reporting & frame protection

Green

CSP violations are reported to /api/csp_report.php (legacy report-uri + modern Reporting API); frame-ancestors allowlist for public pages, SAMEORIGIN or DENY on sensitive routes.

Reference CVD: Vulnerability reporting & triage

Green

Coordinated vulnerability disclosure via support@streamwizard.de, acknowledgement within 72h, initial triage usually within 7 days, /.well-known/security.txt with PGP key available.

Reference EXT: External platforms

Orange

Discord, Twitch, Kick, Stripe, Google, and Trustpilot operate under their own responsibility; outages or policy changes there are outside our direct control.

Reference LOC: Local bot operation

Orange

Local OBSBot caches, OAuth tokens, config files, and exported video data live on the user system and must be protected there via disk encryption, user permissions, and up-to-date antivirus.

Reference NOW: Immediate action required

Green

No red user warning is currently listed. Critical immediate actions would be clearly marked here and additionally communicated via status page/mail.

implemented / normaldepends on external services or user operationimmediate action required

1. Standards we follow

OWASP Top 10 (2025) – the ten most critical risks for web applications.
OWASP ASVS v4.0.3 – requirements catalogue for secure web applications (Level 1 as a baseline, Level 2 for security-critical paths such as login, licensing, payments).
OWASP Cheat Sheet Series – concrete guidance on sessions, CSP, password/token storage, logging, etc.
OWASP Secure Headers Project – reference for security-related HTTP headers.

We treat these standards as an ongoing process: controls are reviewed regularly and adapted to new recommendations.

2. OWASP Top 10 (2025) – how we address the risks

Risk	Controls at StreamWizard
A01 – Broken Access Control	Centralized session checks and a fail-closed access guard, role-based access (owner/delegate/admin), license and API-key validation, signed one-time tokens for downloads, tenant delegation with revocation, non-delegable admin entitlement for Streamstats. Server-side image fetches with creator-influenced URLs pass through a central SSRF guard (https-only, blocking private/loopback/link-local/CGNAT targets via DNS resolution, IP pinning against DNS rebinding, redirect revalidation).
A02 – Security Misconfiguration	Strict Transport Security, Content Security Policy with nonces, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection: 0 (OWASP-compliant), hardened .htaccess rules for API, assets, and no-store on sensitive API endpoints.
A03 – Software Supply Chain Failures	Vendored third-party libraries with Subresource Integrity (SRI) and a versioned vendor manifest with drift checks; continuous CVE scanning (OWASP dependency-check) and SBOM generation (CycloneDX) of the Java modules in CI, build fails at CVSS ≥ 7; pinned dependency versions; full third-party list published on the site.
A04 – Cryptographic Failures	Sensitive identifiers and centrally held feature tokens are stored using the enc/hash model: SHA-256/HMAC-SHA-256 for lookups, AES-GCM for reversible values. TLS 1.2+ enforced, HSTS active, secret keys are rotatable and documented.
A05 – Injection	Prepared statements (PDO) only for SQL, context-aware escaping (htmlspecialchars with ENT_QUOTES), strict input validation at system boundaries.
A06 – Insecure Design	Data minimization (e.g. only control metadata in backup queues and no permanent storage of Streamstats chat text), single-instance lock for license enforcement, layered permission models for delegates.
A07 – Authentication Failures	OAuth via Discord/Twitch/Kick, secure session configuration (HttpOnly, Secure, SameSite), session regeneration after login for all logged-in users, session token entropy per OWASP recommendation, brute-force protection via rate limiting.
A08 – Software or Data Integrity Failures	Signed release artifacts (YubiKey/PKCS#11), fail-closed runtime signature verification of the JAR before installation by the updater (pinned signer fingerprint), SHA-256 integrity header (Repr-Digest) on static downloads, signed one-time download links, verified Stripe webhook signatures.
A09 – Security Logging & Alerting Failures	Security events are logged (logins, API calls, download events, SSRF blocks). IP addresses are anonymized to prefixes (IPv4 /24, IPv6 /64); sensitive values are not written to logs. Critical patterns (clustered auth failures, invalid OAuth states, CSP/SSRF spikes) auto-escalate via thresholds and alert – deduplicated and fail-open – through a Discord webhook and/or email.
A10 – Mishandling of Exceptional Conditions	Security-critical paths (auth, license, crypto, signature verification, access control) are fail-closed – on error access is denied, not granted. No silent swallowing of exceptions (logging required), no stack-trace leaks to users (display_errors disabled, generic error pages). Documented exception-handling policy.

3. Additional technical controls

Content Security Policy with a per-request nonce for scripts and styles.
Rate limiting on API and login endpoints against brute force and scraping.
Subresource Integrity (SRI) for first-party and vendored assets.
Cookie consent layer with separated Necessary / Analytics / Marketing categories.
Documented key rotation for API, crypto, and webhook secrets.
Separation of license data and bot control data – delegates do not get access to payment or license information.
Central SSRF guard for server-side image fetches: https-only, blocking private/loopback/link-local/CGNAT targets via DNS resolution, IP pinning against DNS rebinding.
Active security alerting: clustered critical events auto-escalate (threshold + dedup) via Discord webhook and/or email.
Continuous supply-chain scanning: CVE checks (OWASP dependency-check) and SBOM (CycloneDX) of the Java modules in CI, runtime signature verification of update artifacts before installation.

4. Responsible disclosure

Please do not disclose vulnerabilities publicly. Report them confidentially:

Email: support@streamwizard.de
Subject: Security Report - StreamWizard

We acknowledge reports within 72 hours and usually provide an initial triage within 7 days. Coordinated disclosure after a fix is available is explicitly welcome.

5. Note on compliance

"OWASP-aligned" here means: StreamWizard follows the OWASP projects listed above and actively implements their recommendations. This does not constitute an official certification by OWASP or any external auditor. OWASP is a registered trademark of the OWASP Foundation.