Thanks for helping keep Video Commander and its users safe. This document explains how to report a vulnerability in Video Commander and what to expect in return.

This is the releases repository. The application source is closed, so please use the private channels below to reach us — do not rely on a public issue.

Please report privately. Do not open a public issue or discussion for a suspected vulnerability — a public report can hand a working exploit to attackers before a fix ships.

Report through either channel:

• Email: security@video-commander.com. Encrypt with our PGP key if the report is sensitive (key available on request).
• GitHub: use this repository's Security → Report a vulnerability form to open a private advisory.

Please include, as far as you can:

• the affected version (Video Commander → About shows the build) and your OS;
• a description of the issue and its impact;
• steps to reproduce, and a proof-of-concept if you have one. For anything involving a media file or manifest, attach the exact file that triggers it — these issues depend on precise bytes.

• Acknowledgement within 3 business days.
• An initial assessment — severity and whether we can reproduce it — within 10 business days.
• Coordinated disclosure. We fix first, then disclose. We will keep you updated, credit you in the release notes if you'd like, and agree a disclosure timeline with you. Please give us a reasonable window to ship a fix before publishing details.

Video Commander auto-updates, so a fix reaches users as the next signed release published here.

Video Commander is an offline desktop application that opens and parses untrusted media files and manifests. The most valuable reports concern:

• Crashes or memory-safety issues from a malformed media file you open — the container and codec inspection paths.
• Manifest handling — HLS and DASH parsing/validation.
• The auto-updater — signature verification or anything affecting release integrity.
• Escaping the app's sandbox — a path that turns opening a file or page into filesystem, network, or program-launch access beyond what the feature intends.
• Handling of remote/cloud credentials for storage and transcoding.

• FFmpeg itself. Video Commander downloads FFmpeg to your machine at runtime and does not redistribute it; report FFmpeg bugs to the FFmpeg project. Report to us only if the problem is in how Video Commander downloads, verifies, or invokes FFmpeg.
• Issues that require an already-compromised machine or a malicious local administrator.
• Automated scanner output with no demonstrated, exploitable impact.
• Missing best-practice hardening with no concrete attack. (Still welcome — just not treated as vulnerabilities.)

Because the app auto-updates, only the latest released version is supported. Please reproduce against the current release before reporting.

We will not pursue or support legal action against researchers acting in good faith: who make an effort to avoid privacy violations, data destruction, and service disruption, who use only their own installation and files, and who give us a reasonable chance to remediate before disclosing. Do not target other users.