# Security and responsible use

## Browser sessions

The prototype can ask `yt-dlp` to read cookies from a locally selected browser. Cookie values are not stored by the app, but they grant account access and must be treated as credentials.

- Never log, export, upload, or commit cookie databases or extracted cookie values.
- Keep browser selection explicit.
- Do not turn cookie access into a hidden background operation.
- Use a separate low-privilege browser profile when appropriate.

## Process execution

Keep executable paths and argument arrays separate. Do not replace `Process` with shell interpolation. Validate URLs and destinations before launching tools, and retain tests for arguments containing spaces or unusual characters.

Only execute trusted `yt-dlp`, FFmpeg, ffprobe, and Deno binaries. If the prototype downloads tools, verify HTTPS origin, signatures or checksums, version policy, and file permissions.

## Files and lifecycle

Record only into a user-selected writable directory. Avoid overwriting unrelated files. Preserve graceful stop and finalization when the app quits, and make cleanup target only artifacts created by the active recording.

## Distribution

The buyer must choose and review app signing, hardened runtime, sandboxing, notarization, update delivery, and bundled-tool licenses. No certificate, Apple account, browser data, recording, or secret is included.

## Remote or multi-user versions

A service rewrite adds substantial risk. Require authentication and authorization, isolate jobs and files, restrict destinations and source URLs, enforce time, bandwidth, concurrency, and disk quotas, prevent internal-network URL access, and delete retained media on a documented schedule.

## Legal use

The source makes recording technically possible; it does not grant permission to copy a stream. Record only content you own or are authorized to save, and review platform terms, copyright, privacy, and local law before distribution or use.
