Security and compliance

tauri-plugin-webrtc is licensed under either Apache License 2.0 or MIT, at your option. CrabNebula stewards it as free and open-source software. COMPLIANCE.md is the authoritative statement.

Licence

MIT OR Apache-2.0, the usual dual licence of the Rust and Tauri ecosystems. The texts are in LICENSE-MIT and LICENSE-APACHE. qrtc and its vendored crates are licensed the same way.

What the plugin exposes

• Only windows you grant. The commands are reachable only from windows whose capability includes webrtc:default or one of its sets.
• No capture. The permissions cover networking and media transport. Camera, microphone and screen capture stay under the webview's own getUserMedia permission handling.
• No cross-origin frames. The shim reaches IPC only from the top document or a same-origin frame.
• Bounded. At most 16 peer connections per webview by default, all closed when the page navigates or the window closes.
• No unsafe code of the plugin's own.

Cyber Resilience Act

CrabNebula supplies the plugin outside any commercial activity, so under Regulation (EU) 2024/2847 it acts as an open-source software steward (Article 3(14)), not as a manufacturer. The steward obligations of Article 24 apply to it.

An app that ships the plugin in a product on the market is that product's manufacturer. It must exercise due diligence on the plugin and on qrtc as components (Article 13(5)). The two COMPLIANCE.md files carry the facts that due diligence needs.

Supply chain

• sbom/tauri-plugin-webrtc.cdx.json: CycloneDX 1.5 SBOM of the plugin with its default features.
• The engine's advisories, SBOM drift and interop checks run in qrtc's CI.
• Commits and releases are signed.

Reporting a vulnerability

Use GitHub's private vulnerability reporting on the repository (Security tab, "Report a vulnerability"). Please do not open a public issue. A vulnerability in the engine can go to either repository.