If you discover a security vulnerability in yt-pipeline, please do not open a public issue.
Instead, email the maintainer directly at the address listed on the GitHub profile, or open a private security advisory on GitHub: https://github.com/kharkilirov1/Ytpipe/security/advisories/new
- A clear description of the vulnerability
- Steps to reproduce
- Affected versions (if known)
- Any potential impact
- Acknowledgment: within 72 hours
- Fix: typically within 1–2 weeks, depending on severity
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
- Never commit
.env: The file contains API keys..envis in.gitignore— keep it that way. - LLM API keys: Rotate regularly. Use environment variables, never hard-code in source.
- YouTube OAuth: The upload stage requires OAuth credentials. Store them securely, never in version control.
- Thumbnail/web images in out/: Rendered output in
out/andprojects/<slug>/is gitignored by default — do not accidentally commit large binary outputs. - Dependencies: Run
npm auditperiodically. This project pins Remotion 4.0.x and React 18.3.x.