This project handles local configuration, authenticated API requests, media processing, and an optional local HTTP API. Security issues are taken seriously.
Do not include real account details, session material, private lecture metadata, private downloaded media, local config files, or prompt logs containing private material in issues, PRs, screenshots, logs, or test fixtures.
Changes to these areas need careful review:
- authentication handling
- local API server authorization
- download job creation and idempotency
- WebSocket event payloads
- path handling and output filenames
- FFmpeg invocation and media pipeline behavior
- mpv process supervision, JSON IPC socket ownership, and loopback capability URLs
- rate limiting and retry behavior
- logging and error reporting
Keep config.json and generated job/state files private to your user account. Use sample config files for docs and tests. Do not commit real credentials or private downloaded content.
The default player starts mpv without user configuration or scripts, verifies an owner-private IPC socket, and sends the tokenized loopback stream URL only over JSON IPC. Do not add media URLs to mpv argv, logs, errors, screenshots, or review artifacts. The legacy blocking player is opt-in only and must never be an automatic fallback for IPC failures.
Use GitHub private vulnerability reporting when available. If unavailable, open a minimal public issue asking for a private channel, without including sensitive details.