Please update to the latest release before reporting an issue that may already be fixed.

If you believe you’ve found a security vulnerability in FrameFetch, please report it privately. Do not open a public issue for exploitable flaws.

• GitHub Security Advisories (recommended):
  https://github.com/sumitvibecoder/FrameFetch/security/advisories/new
• Or contact the maintainer: @sumitvibecoder

• A clear description of the issue
• Steps to reproduce (PoC if possible)
• Affected version / commit
• Impact assessment (what an attacker could do)
• Any suggested fix (optional)

• Acknowledgement within a few days when possible
• An initial assessment and next steps
• A fix or mitigation timeline depending on severity
• Credit in the advisory/release notes if you want it (optional)

Please give us reasonable time to fix and release before public disclosure.

• Remote code execution or local file overwrite via the web UI / API
• Path traversal when serving or saving files
• Exposure of secrets (auth cookies, passwords, API keys, proxy credentials)
• Cross-site scripting (XSS) or CSRF in the local web UI
• Insecure handling of uploaded cookie files or pasted auth requests
• Dependency vulnerabilities that are exploitable in this app’s usage

• Issues that only affect misuse of third-party sites (e.g. “yt-dlp can’t download this private video”)
• Social engineering or phishing against end users
• Denial of service against YouTube/Instagram/other platforms
• Vulnerabilities in upstream projects alone (report those upstream), unless FrameFetch worsens them
• Reports that require unrealistic local access already equivalent to full machine control
• Requests for help bypassing DRM, paywalls, or account protections for unauthorized access

FrameFetch stores sensitive local data such as:

• config/auth.json
• config/proxy.json
• config/cookies/

Contributors and reporters must never commit or paste real secrets into issues, PRs, Gists, or discussions. Use redacted examples only.

If you accidentally push secrets to GitHub:

1. Rotate/revoke the exposed credentials immediately
2. Remove them from git history if needed
3. Notify the maintainer if the leak is in this repository

• Run FrameFetch on 127.0.0.1 unless you intentionally need LAN access
• If binding to 0.0.0.0, only do so on trusted networks
• Keep Python and yt-dlp updated
• Treat cookie uploads and pasted HTTP requests as highly sensitive
• Do not expose the app directly to the public internet without additional protections

We rely on packages such as Flask and yt-dlp. If you find a vulnerable dependency:

1. Confirm it affects this project’s usage
2. Report privately if exploitable
3. Or open a PR bumping the dependency with a short risk note

FrameFetch is intended for downloading content the user has the right to access. Security research should not include unauthorized access to accounts, systems, or copyrighted content.

Responsible disclosure helps keep FrameFetch and its users safer. We appreciate your help.