Our approach
DevXR separates management in Studio from public viewing. A model is intended for public sharing only after an explicit publish action. This page documents visible behavior and sensible precautions without claiming certification, invulnerability or guarantees that are not documented.
Security principles
We favor least privilege, server-side decisions for sensitive operations and explicit publication. No Internet-connected system is absolutely invulnerable; controls require maintenance, testing and responsible use.
Authentication and client-server separation
DevXR Studio uses Firebase Authentication for dashboard access. A technology name is not a guarantee by itself: authorization decisions must remain server-side and cannot rely on hiding interface controls. This marketing repository cannot certify the entire production backend.
Private and published models
A private model is not intended for public access. Publishing creates a public viewing experience; unpublishing is the action to use when that access must stop. Check the status in Studio and do not distribute a public URL for confidential content.
Public URLs and embeds
Anyone with a public URL may forward it. An unguessable-looking identifier and `noindex` address different concerns but do not authenticate a visitor. An embed is visible from its host page, so privacy also depends on who can access and share that page.
Imported files and storage
DevXR Studio accepts GLB files. Product documentation describes validation, separate processing and no public serving of an unvalidated original. Do not place secrets in object names, textures or metadata, and upload only assets you are authorized to process.
HTTPS and secrets
Public DevXR domains use HTTPS. It protects transport between browser and service; it is not end-to-end encryption or a guarantee against every threat. Backend secrets do not belong in a browser bundle, GLB or shareable URL.
Unpublishing and deletion
Unpublishing addresses public viewing; deletion addresses resource management. Keep your own source copy when needed. Backup, purge and recovery timelines are not contractually stated in this repository, so ask for written confirmation when a project has specific requirements.
Technical service providers
The marketing site uses Vercel Analytics and Formspree for its contact form. Product documentation identifies Firebase Authentication for Studio. A provider list alone does not establish regulatory compliance.
Report a vulnerability
Email contact@devxr.fr with reproducible steps, affected URLs and observed impact. Do not include passwords, tokens or confidential client models, and avoid actions that alter data or affect other users. The general contact will route the report.
Limits and user responsibilities
Confirm your rights to each asset, optimize it, check publication status and share URLs deliberately. Do not publish secrets or unnecessary personal data. Seek written, context-specific confirmation for legal, retention or availability requirements.
Frequently asked questions
Is a private model indexed?
A private model is not intended for public access. Lack of indexing must never be treated as access control.
Is a public URL confidential?
No. Treat it as shareable with anyone who receives it or to whom it is forwarded.
Does noindex protect a file?
No. It asks search engines not to index a page; it does not authenticate visitors.
How do I report a vulnerability?
Use contact@devxr.fr without attaching secrets or client data, and provide reproducible steps and impact.
What happens when a model is unpublished?
Unpublishing is intended to stop the public viewing experience. Ask for specific confirmation if a contract requires a defined purge process.