Please do not open a public issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting.

Include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact

You can expect an acknowledgement within 48 hours and a fix or mitigation plan within 14 days depending on severity.

Dependencies are monitored automatically via Dependabot. Security patches are reviewed and merged promptly.

captioneer is a local CLI tool — it does not run a server, handle user accounts, or transmit data beyond translation requests to Google Translate. The main areas of concern are:

• Malicious input files causing unexpected behaviour (video or SRT files)
• Command injection via filenames passed to ffmpeg