Would you be able to consider adding an option to enable header-auth bypass (also known as custom proxy headers) in the Security Spy app please?

I self-host Netbird and use the reverse proxy feature to access applications I host at home. Most of these are used via https where authentication is done via Google OAuth, but a number of these open-source apps have mobile clients (such as Immich and location tracking app Dawarich) which aren't compatible with OAuth redirections, so they have an option to define custom headers in the app that Netbird is configured to pick up.

Within Netbird I define the header name and a random token against the URL I use to access the app, which I then copy into the app, e.g.

I would like to do the same with the Security Spy app so that my family can access this service without exposing ports on the internet. I don't want to install the Netbird client (or Tailscale) on each family device just for the occasional app use as it can be a battery drain.

Many thanks,

Paul.

Can or will Security Spy be able to grab that AI time marker for such scrubbing. If you use homekit secure video, one camera gets the Apple intelligence AI anaylsis for free. So why not use it.

I'm checking almost daily and I'd love to get the new features that Golden Gate has to offer.

The messages suggest that recording has stopped but as near as I can tell it picked right up again.

Is this a new problem I need to be worried about, or just something different in 6.2? I really don't need to know if recording paused momentarily for a few seconds while I was asleep (although there's actually no useful indication of when it happened.)

I love SecuritySpy. I run it with 11 cameras of my own. I've been building a standalone async Python library for it, aiosecurityspy (pip install aiosecurityspy), which will eventually power a Home Assistant integration. That integration is still in active development and not ready for use yet, but the library is published and meant to be reusable by any Python project. I'd like to run an idea past you before assuming anything.

What works well today. The URL Generator's authentication tokens are excellent. A token for live video on one camera opens exactly that and nothing else, and it never exposes the account password. That's the right security model for anything that hands a stream URL to ffmpeg, go2rtc, VLC, or similar tools, which tend to print URLs in their logs.

Where integrations run into trouble. Each token covers one camera and one resource, and the only way to create one is the URL Generator window on the Mac. With my own 11 cameras, that means opening the window and pasting 11 URLs, then doing it again whenever the account changes. Asking every user of an integration to do that doesn't scale, so in practice integrations fall back to putting base64 username:password in auth=, which exposes the whole account wherever that URL ends up.

The suggestion. An Integration tokens screen, perhaps under web server or account settings, where an admin could:

• Create a named token (e.g. "Home Assistant") tied to a specific account
• Choose which cameras it covers: all, or a selection
• Choose which resources it grants: live RTSP, snapshots, HLS/MJPEG, event stream, captures
• See when each token was created and last used, and revoke it independently of the account password

A token created this way could replace the account credentials in a client's configuration entirely. It would be least-privilege by design, and revoking one integration wouldn't break the others.

Optionally, an authenticated endpoint that issues such a token (an admin-only equivalent of the URL Generator) would let integrations set this up automatically. The screen alone would already solve most of it.

This is not blocking me. In the meantime, aiosecurityspy is getting a local RTSP relay: the client connects to a local address, and the library adds credentials only on its own connection to SecuritySpy, so the password never appears in a URL any external tool sees. It works, but a first-class token in SecuritySpy would be cleaner for every integration, including Homebridge, Scrypted, and others. If you do add token support, the library would adopt it right away.

Is this something you'd consider worth building? Happy to share details on how the library uses the API if that's useful.

Thanks for SecuritySpy, and for the URL Generator tokens in the first place!

I have a TV that is mainly used to display SecuritySpy via AppleTV. Before tvOS 27 I could power off the TV and the next day I could power it back on and it would pick right back up with the camera group that had been showing. Now, upon power on the Apple TV always goes to the home screen and not back to SecuritySpy. Is this something introduced by tvOS 27 that cannot be changed?

Thanks, Marty

The iOS app registers for notifications with a GET request that includes a 64-bit reference number (ref=<64-bit value>) identifying that specific registration. When a motion event fires, the server is supposed to send that same ref back in the push payload so the notification extension can match the incoming push to a pending registration, then fetch the image using the connection info tied to that match.

On registration, the app sends a 64-bit reference number identifying that request, e.g.:

ref (64-bit, as registered) = 0x1A2B3C4D5E6F7890

The server is supposed to echo that same value back in the push payload so the phone's notification extension can match the incoming push to the registration it made, then fetch the image using the connection info tied to that match.

What actually gets stored and pushed back is the value truncated to a 32-bit signed int — only the low 32 bits survive:

ref (as pushed back) = 0x5E6F7890

(Hex placeholder to illustrate the mechanism, not a real captured value — but the relationship is exact in every case I captured: low 32 bits preserved, high 32 bits silently dropped.) It's consistent with the value being written through a %d-style (32-bit) format specifier somewhere in the server's storage/push code, where a 64-bit-safe specifier is needed.

Why the failure is silent instead of a timeout: the extension never gets far enough to hit the network. It receives the push, tries to match the truncated value against the full ref it registered with, finds no match, and gives up in under 30ms — before ever calling out to fetch the image. The fetch isn't failing; it's never attempted.

Confirmed server-side, not device-side: registered the same phone against two server instances the same day — one running the current major version, one running the version in question. The current major version stored/pushed the full 64-bit ref intact; the other truncated it. Same device, same app build, same day, different result depending only on server version.

Confirmed not fixed by the latest point release: binary-diffed the newest 5.x build against the prior one specifically to check this. The push payload format and ref handling are byte-identical between the two — whatever else changed in that release, this wasn't touched.

Also ruled out: valid end-to-end cert chain, correct app entitlements per the actual provisioning profile, and a from-scratch reinstall with all local state wiped — identical failure on a completely fresh, freshly-licensed install.

Given that the current major version's push payload already formats this value correctly, and the fix on the older version's side would just be widening how the ref is stored/formatted rather than any kind of redesign — is this a known issue that's been triaged and just hasn't been prioritized, since it happens to nudge anyone who wants working image previews toward the paid upgrade?

I Can share the raw before/after capture if anyone wants to verify.

As the title states is there a way to have each camera record on site via ssd plugged into mac studio and also have it save off site to a NAS device or cloud concurrently

If each cameras are recording live constantly 24/7 creating different files hourly and the files are being recorded to local drive attached to mac studio and off site via nas/cloud. If something happens catastrophic to house fire, weather what ever and it destroys everything locally and you need to retrieve files remotely.

Does the said files that are currently recording midway into or before the hour finishes become corrupt?!? Are you able to play back the file to its full extent up to where the recording terminated abruptly?!?

I would really like to get away from using Intel silicon. Is the new Neo a candidate?

9 cameras not a power user

Dale

https://bensoftware.com/securityspy/web-server-spec.html

HTTP multipart "server push" video stream

• jpeg (default; the only codec that works in HTML img tags)

• h264

• h265

• h26x (the server chooses between H.264 and H.265)

RTSP video/audio stream

An RTSP video/audio stream, which can be received by any RTSP player, such as VLC.

HTTP Live Streaming video/audio stream

An H.264 HTTP Live Streaming video/audio stream, which can be used in Safari within an HTML <video> tag.

Which of these, if any, is equivalent to an unprocessed (ie, Security Spy is not re-encoding) relay from the cameras?

AI Image Review seems to show that the detection trigger is happening on less than 15% certainty. How do I resolve? AI Detection is set to 50%.

Thanks!

1) So is this coming in 1-2 years or in 6 years?

2) Should I get a powerful Mac PC or a basic one and upgrade when voice commands mature.

Any ideas?

I am trying to maximize the image quality of my cameras. "Image Quality Review" is a great tool. My question, how often does it review camera images. Once a day? Other? Can I force a review to see sSpys's assessment of camera image after/as I tweak camera settings.

Thank You.

The newest macOS has these fancy "handoff" features where I can use my iPad keyboard/trackpad to control the Mac Mini, which is great because I don't want to have a keyboard/mouse hooked up to it.

I configured all my SecSpy windows in "spaces" (full screen views).

space 1 = full screen all camera grid (when I say "full screen" I mean macOS full screen window mode, where you click the green dot.

space 2 = cam 1

space 3 = cam 2 ...etc...

All of them full screened.

Then I changed my keyboard shortcut to flip between spaces to option-left/right arrow keys. Now I can quickly hit option-left/right arrow to flip between full screen cameras/all camera grid, etc.

I love this configuration.

One downside: when you restart Security Spy, it doesn't remember all your full screen window configuration. It starts up with all the windows non-full screen piled up on top of each other in the "Desktop space" (where non-full screened windows land by default).

Any way we could fix this up a bit and make SecSpy restore all windows to their full screen glory (and their specified ordering of spaces) at startup?

The full-screen "kiosk" mode that's built into SecSpy is always rotates between cameras. That's nice, but I prefer generally to leave the monitor on the multi-cam grid view, and then quickly flip to a full screen individual camera if I want to look at something carefully.

One other note on this topic: macOS default keyboard shortcut for window fullscreen is control-command-F. Security Spy window don't respond to that shortcut, but pretty much all other apps do. Could we add it?

Thank you!

macOS 15.6.1 + secSpy 6.13

Example:

Camera FPS = 8

If I send 8 JPEG requests in 1 second (1 request every 125ms), and the average SecSpy response time (JPEG received) per request is 250ms, does SecSpy drop 4 out of 8 of my requests, or does it manage a pool of JPEG encoder threads that will consume whatever memory & CPU cycles is needed (up to the limits of the machine or whatever limits you've specified) to fulfill every request?

I'd envision either scenario as roughly:

Serialized JPEG encoder:

Frame 1 <> request 000ms <> SecSpy encoder 1 ready <> deliver JPEG 1 <> done 250ms

Frame 2 <> request 125ms <> SecSpy encoder 1 busy <> drop JPEG 2 request

Frame 3 <> request 250ms <> SecSpy encoder 1 ready <> deliver JPEG 3 <> done 250ms

Frame 4 <> request 375ms <> SecSpy encoder 1 busy <> drop JPEG 4 request

etc...

Async JPEG encoder:

Frame 1 <> request 000ms <> SecSpy encoder 1 ready <> deliver JPEG 1 <> done 250ms

Frame 2 <> request 125ms <> SecSpy encoder 2 ready <> deliver JPEG 2 <> done 250ms

Frame 3 <> request 250ms <> SecSpy encoder 1 ready <> deliver JPEG 3 <> done 250ms

Frame 4 <> request 250ms <> SecSpy encoder 2 ready <> deliver JPEG 4 <> done 250ms

etc...

I'm using simplified hypothetical numbers here for the sake of conveying the question (not entirely hypothetical though - I'm seeing JPEG response times of around 180ms to 415ms when I have multiple threads hammering SecSpy with requests).

Thanks!

The error is a “Connection Failed, can’t connect to server” pop-up. I’m running the latest iOS app and Mac-side app.

Was there a recent change in the last 6 months or so that could have affected this?

irritant.

Any way this could be reworked so that "configure settings" is not buried in a list of lesser needed options? It's pretty much the only one I go to every time, although I do like being able to disarm actions for an hour or 3 without digging e.g. when someone is working in the alley.

Any suggestions? I suspect it's something very simple sitting right in front of me, but I'm not seeing it.

Thanks

I know that UniFi Protect is built to work with UniFi cameras, so it's not based on open camera standards like SecuritySpy. However many people seem to love Protect's features, especially its AI skills, and its tight integration with a UniFi network. I'm curious how the user experience compares.

Hi Ben,

A few questions on my camera set up, I'm having trouble getting motion triggers working on any of my cameras.

1. First, I am running all of my cameras at 10 fps, with an I-frame interval at 10 as well, and I believe this means there will be a key frame every second. If I have my motion detection set to 0.5 seconds of motion, do I need to set my I-frame interval to 5? My understanding is that the motion detection only looks like the first frame of a group (key frame).
2. I've attached my trigger and motion record settings, do you see anything wrong here?