Please do not open a public issue for security problems. Instead, report them privately through Report a vulnerability.

Include the app version, your operating system, and the steps to reproduce the problem. We aim to reply within 7 days. Fixes are published in a new release, with credit to the reporter if you want it.

Only the latest release receives security fixes.

• The app works fully offline: every network request is blocked and every browser permission is denied. The only exception is an optional, read-only check for new versions against the GitHub API, which can be turned off in the settings.
• The interface runs sandboxed, with context isolation and a strict Content Security Policy.
• Media is processed in a separate, isolated process.
• Original files are only opened for reading, and the results are always written to a new folder.
• Builds are produced by GitHub Actions, and each release lists the SHA-256 checksum of every file.