Blog

Building Baby Monitor Timmy with GitHub Copilot

How AI pair programming helped ship a privacy-first baby monitor.

By Baby Monitor Timmy · April 2025

Baby Monitor Timmy started with a simple idea: a baby monitor that respects your privacy. No cloud recordings, no subscription fees, no data leaving your home unnecessarily. What made this project unusual is how it was built — from the very first line of code, GitHub Copilot served as an AI pair programmer, turning a concept into a fully functional app in a fraction of the time traditional development would require.

The Human-AI Workflow

The development process followed a clear division of labor: the human acts as CTO — defining features, setting priorities, and making architectural decisions. GitHub Copilot handles the implementation: writing code, running tests, debugging issues, and even distributing releases to testers.

A typical sprint looks like this:

  1. Feature description: The developer describes what the next feature should do, including edge cases and constraints.
  2. Implementation: Copilot writes the code, following the project's existing conventions and architecture.
  3. Testing: Automated end-to-end tests run on two emulators to verify the feature works correctly.
  4. Distribution: Once tests pass, a release APK is built and distributed to testers via Firebase App Distribution.

This cycle — describe, implement, test, distribute — repeats for every feature and bugfix. The human never needs to write code manually, but retains full control over what gets built and why.

From Concept to WebRTC

The project began with the core challenge: real-time audio and video between two phones. WebRTC was the obvious choice, but integrating it with Flutter — handling ICE candidates, SDP negotiation, TURN fallback, and DataChannels — involves significant complexity.

Copilot navigated this complexity step by step: setting up the peer connection, implementing the correct ordering (DataChannel before offer, onTrack before setRemoteDescription), and building the signaling layer on top of Firebase Firestore. Each piece was tested on dual emulators before moving to the next.

Secure Pairing with ECDH

One of the most critical features was the secure pairing system. Two devices need to establish mutual trust without relying on a central server to vouch for their identity. The solution: an ECDH P-256 key exchange over Firebase, combined with a visual verification number (SAS) that detects man-in-the-middle attacks.

Copilot implemented the entire cryptographic chain — key generation, public key exchange, shared secret derivation, SAS computation, and AES-256-GCM encryption for all subsequent signaling. The pairing key never touches the backend; only its SHA-256 hash is used as a Firestore document identifier.

Security Audit: Finding and Fixing Vulnerabilities

AI-assisted development isn't just about writing code faster — it's also about catching mistakes. During a dedicated security audit sprint, Copilot analyzed the entire codebase for vulnerabilities and found six issues that needed fixing:

All six were fixed in the same sprint. This kind of systematic code review — examining every file for security implications — is exactly where AI assistance shines.

Iterative Sprints: How the App Evolved

The app evolved through rapid iteration. Each version brought significant improvements:

Each sprint followed the same pattern: describe the goal, let Copilot implement it, verify with automated tests, and ship to testers.

E2E Testing with Dual Emulators

Testing a baby monitor requires two devices: one in baby mode, one in parent mode. The project uses two Android emulators running simultaneously, with an automated test script that:

  1. Installs the app on both emulators
  2. Navigates through pairing on both devices
  3. Verifies that audio and video connections are established
  4. Tests push-to-talk, camera control, and other features

Since both emulators share the same IP address (10.0.2.15), a direct peer-to-peer connection via STUN is impossible. This forces every test run through the Cloudflare TURN relay — which actually provides better test coverage, since it exercises the most complex connection path.

What We Learned

Building an entire app with an AI pair programmer taught us several things:

Looking Ahead

Baby Monitor Timmy continues to evolve. Upcoming milestones include the iOS version (Phase 3), additional sensor features, and continued security hardening. The development workflow remains the same: a human with a vision and an AI that makes it real.

The security-relevant building blocks now live under clear boundaries in the public baby-monitor-timmy-core repository — including the architectural decisions around pairing, signaling, and backend interfaces.


More Articles