Media parsers process untrusted input. Please report vulnerabilities privately through GitHub's security advisory feature. Do not include real credentials, private media URLs, DRM material, or production files in a report.

Native dependencies are pinned and rebuilt for security updates. A release must not silently substitute a floating FFmpeg snapshot for its declared source archive.