Queuebird deliberately exposes a narrow control surface. It does not provide remote JavaScript evaluation, arbitrary selectors, general browser automation, cookies, browsing history, or CDP access.
- The extension operates only on
https://music.youtube.com/*. - Commands are restricted to play, pause, resume, skip, and queue operations.
- The server binds to loopback by default.
- API routes require an API key. Device IDs provide bounded routing, not authentication or authorization.
- Credentials remain in trusted extension storage and are never sent to the content script.
Do not expose the server directly to the public internet. The bundled server has no rate limiter or per-device authorization. The shipped extension also accepts loopback collector URLs only; remote access requires an audited policy change as well as TLS, access control, and network-layer protection.
Use a long randomly generated API key, keep .env readable only by the local
operator, and rotate the key if it is disclosed. Avoid placing secrets in shell
history, logs, issue reports, or screenshots. Treat other local processes under
the same user account as trusted: they may be able to read browser or Docker
configuration.
Commands are retained in SQLite so browser cursors survive server restarts. This initial release does not provide per-command signatures, expiry, or automatic database retention. Protect and periodically prune the Docker volume if playback history is sensitive.
Track targets are constrained to canonical HTTPS YouTube Music watch URLs and 11-character video IDs. Text metadata is length-bounded and treated as data, never code. Queue acknowledgements are observable-state checks, not a guarantee that YouTube Music will remain unchanged after acknowledgement.
Supported security fixes are released on the latest minor version. Users should update both the server and extension together.
Report vulnerabilities privately through GitHub Security Advisories.