Please do not open a public issue for a security problem. Use private reporting instead, and include the version and the steps or file that trigger it. You should get an answer within a week.

Examples of what counts: a crafted video that runs code or writes outside the output folder, or a way to make the update install something other than an official release.

Only the latest release gets fixes.

• Damaged files are the normal input. The parsers are fuzzed with thousands of damaged files under AddressSanitizer and UndefinedBehaviorSanitizer (tests/fuzz_robustness.py).
• Originals are never changed. Results go to a new file, and that file gets its final name only after it has been completely written to disk.
• Updates run only when you press the button. They download only over HTTPS and only from this project's GitHub releases. The SHA-256 of the archive and the version inside it are checked, and a signed program accepts only an update signed by the same signer. If anything fails, the installed files are restored (tests/update_test.py checks all of this).
• Releases are built from source on GitHub Actions with pinned compiler and tool versions, each checked against a fixed SHA-256. See .github/workflows/release.yml.