Please report suspected vulnerabilities privately through GitHub's Security → Report a vulnerability feature rather than opening a public issue. Include reproduction steps, affected versions, and the potential impact when possible.

Do not include passwords, cookies, API keys, private video links, or other sensitive information in reports.

TubeDrop does not request or store YouTube credentials, browser cookies, or API keys. Downloaded files are written only to the destination selected by the user.