Security fixes are currently made on the latest supported FramePier development line. The next public binary release remains subject to the project's dependency, security, and redistribution release gate.

Do not open a public issue for a vulnerability that could expose user data or execute code. Use GitHub's private vulnerability reporting feature when it is available for this repository. If private reporting is unavailable, contact the maintainer privately before publishing exploit details.

Please include:

• affected FramePier version;
• browser and Windows version;
• reproducible steps;
• expected and actual behavior;
• logs with personal paths and video identifiers redacted.

Do not include cookies, authentication tokens, private video URLs, credentials, or downloaded media.

FramePier intentionally:

• authorizes only extension origin chrome-extension://kclnooibijmfenaldmpkffdbednfipkk/ in the Native Messaging host manifest;
• uses HTTPS and an allowlist of official YouTube, Twitch and Dailymotion hostnames (for Dailymotion only dailymotion.com and www.dailymotion.com, with no credentials or port);
• canonicalizes accepted URLs using a validated YouTube ID, Twitch clip slug, numeric Twitch VOD ID, or Dailymotion x-prefixed video ID, so no other URL component reaches yt-dlp;
• starts Dailymotion downloads with --use-extractors dailymotion and --match-filters !is_live. --use-extractors only selects which yt-dlp extractor may handle the URL. It is not a network sandbox: yt-dlp and the extractor still request Dailymotion's API and media hosts, may follow redirects, and FramePier does not restrict DNS or secondary requests. Safety rests on the narrow URL allowlist, the fixed argument arrays and the hardening flags above;
• shows no Dailymotion thumbnail and adds no Dailymotion host permission or image-source exception to the extension;
• accepts a small fixed JSON command set with a 1 MiB message limit;
• rejects unknown message fields and invalid field types;
• builds all yt-dlp, FFmpeg, Explorer, and registry process calls from explicit argument arrays without a command shell;
• never accepts executable names, command-line fragments, environment variables, or arbitrary folder-open paths from the extension;
• limits active download jobs and kills only the requested job's process tree;
• confines and verifies final output inside the configured local download directory;
• uses a restrictive extension CSP and no remotely hosted JavaScript;
• requests only narrowly scoped browser permissions and explicit supported-site host permissions;
• does not read browser cookies, OAuth tokens, credentials, profiles, or unrelated browsing history.

The helper is not a DRM or access-control bypass. Changes that add credential theft, cookie extraction, protected-stream circumvention, or generic system control are outside the project security model.

Some internal identifiers intentionally retain the former VidDock name so existing installations can be upgraded safely. These include the Native Messaging host name com.viddock.helper, legacy AppData paths under %LOCALAPPDATA%\VidDock, and migration/package markers. They are compatibility identifiers, not the current product name, and must not be renamed independently without a tested migration plan.

Builds retrieve Go from go.dev, FramePier's own build of yt-dlp.exe from the pinned yt-dlp/yt-dlp tag from a verified local file (SHA-256 pinned in scripts/build.ps1; recipe and evidence in third-party/ytdlp-openssl3/), FFmpeg from a verified local directory (11 files, each pinned by SHA-256 in scripts/build.ps1; the shared build's provenance is in third-party/ffmpeg-shared/), and Deno from the official release (pinned version). Every downloaded release artifact is checksum-verified before packaging.

Before every public binary release, the release gate must verify the exact dependency versions, current security advisories, the exact artifacts and hashes being bundled, license and redistribution obligations, and required source/source-availability status. A failed or incomplete gate blocks the public release.

There is no in-app yt-dlp updater: the update_ytdlp command was removed in 0.2.3 and the helper rejects it as an unknown command, so the pinned, verified yt-dlp.exe cannot be replaced at run time. yt-dlp changes only by installing a newer FramePier release.

Release maintainers should retain checksums and third-party notices with build records, scan the complete source tree and relevant Git history for secrets, run the automated test/security checks, and manually inspect the final installer before distribution.

• Browser acceptance tests require interactive Chrome/Brave sessions and cannot be fully represented by unit tests.
• A user-selected writable directory can be changed by other local processes after validation. FramePier rechecks that the final reported file remains beneath the configured folder and is a non-empty regular file.
• Native Messaging host authorization is enforced by Chromium and checked again from the origin argument received by the helper. Local malware running as the same Windows user is outside the browser-extension trust boundary.