textream

CVE-2026-28412: Resource exhaustion through unlimited connections (DoS) > Textream's WebSocket server imposed no limit on concurrent connections. Flooding it exhausted CPU and memory and could freeze the app during a live session. Summary In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server imposed no limit on concurrent connections. Impact Combined with a broadcast timer sending state to all clients every 100 ms, an attacker could exhaust CPU and memory by flooding the server, freezing and crashing the application during a live session. Fix Update to 1.5.1 or later. If you run your own server, cap concurrent connections and limit connections per source. References: - NVD: nvd.nist.gov - GitHub Security Advisory: github.com/f/textream/security/advisories/GHSA-qr… - Fix commit: github.com/f/textream/commit/3524fa96f98ba17025b4… - CVE record (MITRE): cve.org - CVE record (Feedly): feedly.com --- Originally published at iamcanturk.dev.

CVE-2026-28403: Missing WebSocket origin validation (Cross-Site WebSocket Hijacking) > Textream's local WebSocket server did not validate the Origin header. A malicious web page visited by the user could silently connect to it and send commands. Summary In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server accepted connections from any origin without validating the HTTP Origin header during the handshake. Impact A malicious web page visited in the same browser session could silently connect to the local WebSocket server and send arbitrary commands. Fix Update to 1.5.1 or later. If you write your own WebSocket server, compare the Origin header against an allowlist during the handshake and reject anything that doesn't match. References: - NVD: nvd.nist.gov - GitHub Security Advisory: github.com/f/textream/security/advisories/GHSA-wr… - Fix commit: github.com/f/textream/commit/f5ebad82750b9313386c… - CVE record (MITRE): cve.org - CVE record (Feedly): feedly.com --- Originally published at iamcanturk.dev.

Textream: A free teleprompter for Mac, iPhone, and iPad (4.0k stars) What it does All text below is quoted directly from the project README. >A free teleprompter for Mac, iPhone, and iPad. Built for streamers, interviewers, presenters, and podcasters. >Textream is a free, open-source teleprompter that guides you through your script with three modes: word tracking (highlights each word as you say it), classic (constant-speed auto-scroll), and voice-activated (scrolls while you speak, pauses when you're silent). The Mac app displays your text in a sleek Dynamic Island-style overlay, a draggable floating window, or fullscreen on a Sidecar iPad. The iPhone and iPad app adds near-camera reading and presenter-only camera recording. >Paste your script, hit play, and start speaking. When you're done, the overlay closes automatically. iOS 26 Companion: - Portrait and landscape — A fullscreen teleprompter layout adapts to both orientations. - Eye-contact reading position — The active line sits just below the front camera by default, or can be centered in Prompter Settings. - The same three guidance modes — Word Tracking, Classic auto-scroll, and Voice-Activated scrolling use the same behavior as the Mac app. - Selfie video recording — Record mode captures camera video and microphone audio, starts with the front camera, and lets you switch between front and back cameras before recording. - Presenter-only prompt — The translucent scrolling prompt is visible on screen while you record, but it is not burned into the saved video. - Matching fonts — Sans, Serif, Mono, and OpenDyslexic are available on both platforms. >Requires macOS 15 Sequoia or later. Works on Apple Silicon and Intel. Repository f/textream Repository stats |Metric|Value| |:-|:-| |Stars|3,994| |Forks|276| |Last release|v1.7.1 (2026-09-06)| |Languages|Swift 99.6%, Shell 0.4%| |Contributors|15| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|claude (10 commits)| |AI co-authored commits|Claude: 10| Main contributor |Field|Value| |:-|:-| |Name|Fatih Kadir Akın| |GitHub|@f| |Commits to this repo|111 (top contributor)| |Bio|Head of Agentic Experience for @spacefast at @Automattic — prev @WordPress — Building prompts.chat — JavaScript Developer. AI Enthusiast. Author. — @GitHub Star| |Company / Location|@Automattic, @spacefast / Istanbul, Turkey| |Website|fka.dev| |X / Twitter|@fkadev| |Followers|11,574| |Public repos|311| |On GitHub since|2010-02-04|

1: Textream is a free, open-source macOS teleprompter with iOS companion. It offers three guidance modes (Word Tracking, Classic, Voice-Activated), multiple overlay options (Dynamic Island, floating window, fullscreen), and remote/director modes for loca… f/textream

2: Textream is a free, open-source macOS/iOS teleprompter with word-tracking, classic auto-scroll, and voice-activated modes. It features Dynamic Island overlays, remote/director control, multi-display support, and privacy-first design. MIT license. f/textream

3: Textream is a free, open-source macOS teleprompter that highlights every word in real time via a Dynamic Island overlay, plus versatile modes, remote control, and multi-device support. Try it for smoother on-camera delivery. f/textream f/textream

G: Discover Textream, a free open-source teleprompter for Mac, iPhone, and iPad designed for streamers, interviewers, and presenters. It features real-time word tracking, classic auto-scroll, and voice-activated scrolling, all in a Dynamic Island–style o… f/textream