Security fixes target the latest code on the default branch. Older snapshots are not maintained separately. Keep dependencies and external media tools updated.
Do not disclose vulnerabilities, credentials, or private media in public issues. Use the repository's Security → Report a vulnerability option if available. Otherwise, use a private contact listed on a maintainer's GitHub profile. If none is available, open an issue requesting a private reporting channel without including vulnerability details.
Include affected versions, reproduction steps using synthetic data, impact, and any suggested mitigation. There is no guaranteed response time.
Browser cookies are passed to yt-dlp locally. Do not share cookie files, tokens,
or unsanitized logs. Outputs contain source URLs and transcribed content; the
working directory may also contain source metadata and downloaded audio.
The default transcripts/ directory is ignored by Git. If you choose a custom
output directory, exclude it yourself before committing.