Please report security issues privately using GitHub's private advisory form rather than opening a public issue.

Include what the issue lets an attacker do, how to reproduce it, and which version you tested. A fix or mitigation usually ships in the next release.

Nothing leaves your machine. There is no account, no telemetry, no analytics and no crash reporting. The only outbound connections are:

• the sites you paste links from,
• GitHub, to fetch yt-dlp and check for app updates,
• the ffmpeg-static release assets, once, on first run.

Settings and download history live in a local folder (~/Library/Application Support/ABSP on macOS, %APPDATA%\ABSP on Windows). History records titles and file paths, never credentials.

npm run serve binds to every interface so phones on your network can reach it. That is the point of the mode, and it has consequences worth understanding:

• A token is generated by default and printed at startup. Requests to /api/* without it get a 401. ABSP_NO_TOKEN=1 opts out; ABSP_HOST=127.0.0.1 keeps it on the local machine only.
• Traffic is plain HTTP. The token is not encrypted in transit. Fine on a home network, unwise on café or office Wi-Fi.
• The download folder is validated. A client cannot redirect downloads into system locations, but any client holding the token can change it within your writable space and can download the files any job produced.
• There is no multi-user model. Everyone with the token shares one queue and one download folder.

Do not expose this to the public internet. It is not built for that, and doing so also puts you in the position of operating a public download service.

--cookies-from-browser reads your browser's cookie store to access content you are already signed in to. Those cookies are passed to yt-dlp for the duration of a download and are never written to ABSP's own storage or sent anywhere else.

On macOS, Safari's cookie store is protected by the OS and requires granting Full Disk Access to ABSP. That is a real, broad permission — if you would rather not, use Chrome, which works without it.

Releases are ad-hoc signed but not notarised. The signature is valid (so macOS will not call the app "damaged") but it does not identify a developer, and Windows will show a SmartScreen warning.

This means you should verify you downloaded from the official releases page. Proper signing requires paid certificates from Apple and a Windows CA.

yt-dlp and ffmpeg are downloaded at runtime from their official release URLs, not vendored into this repository. ABSP does not modify them. Security issues in those tools should go to their respective projects — and updating yt-dlp from Settings is the fastest way to pick up their fixes.