# Security

Conf Quiz separates the trusted presenter from the public attendee app. The presenter owns the room and answer keys; attendee clients receive only the data needed for the current screen.


# Trust boundaries

| Component | Runs where | Credential |
|----|----|----|
| Presenter service | Speaker computer | Firebase Admin credential |
| Presenter browser | Speaker computer | Random local control token |
| Attendee app | Static host and attendee browser | Firebase web config + Anonymous Auth |
| Firestore | Firebase | Security Rules and optional App Check enforcement |

The Firebase web config and App Check site key are public identifiers. The Admin service-account JSON is a secret.


# Firestore rules

The included rules enforce these boundaries:

- presentation status permits one exact public read and does not expose a room code or session ID;
- join-code documents allow exact reads, never collection listing;
- room data requires Anonymous Authentication;
- an attendee writes only the response document matching their Auth UID;
- a write is accepted only for the active, open question;
- answer types, option IDs, lengths, and numeric ranges are checked;
- raw responses and moderation records are not readable by attendees; and
- result aggregates are presenter-authored and read-only to attendee clients.

Deploy the supplied rules before the attendee URL is public. Firebase Test mode is not an acceptable event configuration.


# Local presenter token

The presenter URL contains a fresh random token. Requests also pass browser origin checks. The server binds to `127.0.0.1` unless you explicitly select another host.

If you bind the presenter to `0.0.0.0`, anyone on the local network can reach the port and attempt to access it. Keep the token private and use a trusted network. The attendee static site does not require the presenter port to be public.


# App Check

App Check helps Firebase distinguish your attendee app from unapproved scripts. Enable it after checking metrics with the deployed site. A wrong hostname or site key can lock out every attendee, so do not turn on enforcement for the first time on stage.


# Intended use

Anonymous Auth makes casual duplicate submissions less convenient; it does not prove identity or one-person-one-vote. Conf Quiz is not designed for:

- elections;
- graded assessment;
- prize-bearing competitions;
- confidential surveys; or
- regulated or high-stakes decisions.

For a conference poll, tell attendees what will be displayed, avoid collecting personal information, and clean up old rooms after the stated retention period.


# Reporting a vulnerability

Report security issues privately to the maintainer. Do not include live Admin credentials, attendee data, or an exploitable public room in a GitHub issue.