Flux processes media locally using bundled and system tools (FFmpeg, yt-dlp, libvips) and never uploads your files. Still, any native macOS app that shells out to external binaries can have a security surface, and we take reports seriously.

Please do not file public GitHub issues for security problems.

Instead, report them privately:

• GitHub Security Advisories (preferred): Report a vulnerability
• Discord: fi3w0 (DM)

Please include, where possible:

• A description of the issue and its impact
• Affected Flux version (see Flux → About Flux) and macOS build
• A minimal reproduction — sample media file, command sequence, or input that triggers the issue
• Whether the issue requires user interaction or can be triggered by parsing untrusted input

Status updates will be sent at each step. Coordinated disclosure is fine — credit will be given in the release notes unless you prefer to remain anonymous.

In scope:

• Code execution or privilege escalation inside Flux
• Unsafe handling of untrusted media files (malformed inputs, path traversal, out-of-bounds writes in the macOS-side glue between Flux and FFmpeg/yt-dlp)
• Issues in the update mechanism (Sparkle appcast, download, signature verification)
• Leakage of data outside the explicitly-networked workflows (downloads, metadata, artwork, updates)

Out of scope (report upstream instead):

• Vulnerabilities inside FFmpeg, yt-dlp, libvips, or Sparkle themselves — report these to their respective maintainers; we will track and bump our bundled versions in response
• Issues that require the user to already be running attacker-controlled code on their Mac
• Spoofing of the fiwlabs.dev domain, GitHub, or other infrastructure we do not own

Flux is in active development. Only the latest released version receives security fixes.