Security fixes are applied to the latest released version of YTLite.

Please use GitHub's private security advisory feature for this repository instead of opening a public issue. Include the affected version, impact, reproduction steps, and any suggested mitigation. Do not attach cookies, credentials, private media URLs, or downloaded media.

YTLite deliberately avoids a shell, validates official yt-dlp downloads with published SHA-256 checksums, redacts command previews, and does not persist raw arguments. Reports that show a way around these boundaries are especially useful.