bilawalsidhu/gods-eye-view

What it is

God's Eye View (GEV) is an MIT-licensed, vanilla-JS CesiumJS/Vite client from Bilawal Sidhu and Sameh Khamis at Halfpixel. It is a local web app that talks to public data feeds and a few paid providers. The page states it is "not a hardened production service". The security-relevant parts are how it handles keys, what it exposes on the network, and what it sends to third parties.

Preconditions / Affected

• Node.js 24.x (24.14.0 or later) or 26.x. The setup doctor warns about Node 25, which is end-of-life.
• Pinokio 8.2 or later if you install through Pinokio. Older Pinokio versions fail the install.
• Older GEV versions query public Overpass servers, which now refuse them. Traffic, Mapped Installations and ALPR stay empty until you update.

What to do

Local run:

git clone https://github.com/bilawalsidhu/gods-eye-view.git
cd gods-eye-view
npm ci
npm run doctor
npm run dev

The app opens at http://localhost:4173. npm run doctor reports Node/npm readiness and where each provider key was found, without printing the values.

Key handling

• Add keys through POWER UP → Provider Settings. They are written to the repo-root .env (or Pinokio's pinokio/ENVIRONMENT) as plaintext, made owner-only first, and excluded from Git.
• On macOS, ./scripts/dev-fresh.sh reads keys from the Keychain, which the page calls the stronger storage option.
• Do not enter credentials in Pinokio 8.0.40's native Configure panel. It does not save the nested app file correctly and it logs the submitted values. The 8.2 fix covers installation only. The page does not say the Configure issue is resolved.
• Google Maps and Cesium ion keys are the only keys the browser sees. Restrict both at the provider; SECURITY.md has the steps.

Sharing on a LAN is opt-in:

npm run dev -- --host 0.0.0.0 --port 4173

• A LAN hostname needs GEV_ALLOWED_HOSTS=globe.lan, because binding to 0.0.0.0 does not trust arbitrary Host headers.
• Provider Settings is disabled while the server is shared.
• Pinokio LAN and Cloudflare sharing stay disabled. For remote access the page recommends a separately reviewed authentication proxy.
• Rate limits are tunable with GEV_RATELIMIT_OPENAI_PER_MIN and GEV_RATELIMIT_GOOGLE_PER_MIN (see .env.example). The page says these are not billing caps, so set provider quotas and billing alerts first.

flowchart LR
  B[Browser] -->|Google Maps, Cesium ion keys only| P1[Map providers]
  B --> S[Local server, localhost]
  S -->|OpenAI, AISStream, OpenSky, camera frames| P2[Keyed providers]
  S -.->|SSRF checks, response caps| P2
  L[LAN or remote client] -.->|opt-in 0.0.0.0| S

How it works

• Server-side brokering. The page says every API touching a private key goes through a server-side proxy with SSRF protection, response caps and sanitized errors. This covers OpenAI, AISStream, OpenSky OAuth and camera frames.
• Voice. The browser receives only a short-lived Realtime session token, never OPENAI_API_KEY.
• HLS camera proxy. It allows two concurrent sessions. Each retains at most 12 segments and 24 MiB in memory. Downloads are capped at 4 MiB with a ten-second deadline. Redirects, off-origin references, encrypted playlists and non-MPEG-TS segments are refused.
• Experimental ChatGPT/Codex OAuth for voice.
• It is opt-in and the API-key path stays the default.
• GEV reads Codex's auth.json credentials but does not write or refresh them.
• The server refuses the OAuth path for non-loopback clients.
• The login button runs codex login.
• The page says no supported third-party Realtime contract for reusing Codex tokens is confirmed. A successful token mint does not establish billing or support terms.
• An MCP server mode lets Claude Desktop, Codex or ChatGPT desktop open the globe (docs/MCP_SETUP.md).

Caveats

• Data may be delayed, modeled, inferred or wrong. The page says not to use it for navigation, emergency response or other safety-critical purposes.
• Traffic is simulated from aggregate location data. CCTV poses and rocket trajectories are coarse estimates.
• The ALPR layer shows OpenStreetMap-tagged camera locations only. The project forbids person-tracking, named-person search and face recognition features.
• Bundled datasets, including the Nepal flood scene, carry their own terms, some non-commercial (DATA_SOURCES.md).
• The page's Google 3D Tiles billing figures are described as approximate for mid-2026. Billing must be enabled for the Google route.
• The page does not describe an audit of the proxy or SSRF protections. Review SECURITY.md before relying on them.