Security
Lan-Share uses short-lived pairing codes and session credentials to reduce accidental exposure. A sender creates an 8-digit code, the receiver enters it, and both sides receive temporary session credentials for that room. Session credentials are sent in request bodies, not in URLs.
File transfer is intentionally receiver-confirmed. The receiver can see file metadata before the file bytes are requested, and file content transfer begins only after the receiver chooses to download. This reduces unwanted transfers and gives the receiver a chance to reject unexpected files.
Modern browser security features are required. Lan-Share expects WebRTC, WebSocket, Web Crypto, Blob and file APIs, and a secure HTTPS origin in production. HTTPS is required because browsers may restrict cryptography, clipboard, device, and networking capabilities on untrusted origins.
Lan-Share does not intentionally store transferred file contents. Operational logs and analytics are kept for reliability and abuse diagnosis, and sensitive runtime fields are redacted where the application records project logs.
Security still depends on user behavior and device trust. Verify the receiving device, do not share connection codes in public channels, keep your browser updated, and avoid sending sensitive files over networks or devices you do not control. Report security issues to security@lan-share.com.