Security
Policy
Responsible disclosure, security guidelines, and how we handle vulnerability reports for UMD.
Our Security Commitment
UMD is an open-source CLI tool. We take security seriously and appreciate responsible disclosure from the community.
This document outlines how to report vulnerabilities, what we consider in scope, and what you can expect from us when you report an issue.
Reporting a Vulnerability
If you discover a security vulnerability in UMD, please report it responsibly. Do not open a public GitHub or Codeberg issue for security vulnerabilities.
Send your report to the maintainer privately via Codeberg's private issue tracker or direct message. Include as much detail as possible: steps to reproduce, potential impact, and any suggested fixes.
What Is In Scope
We are interested in vulnerabilities that could affect users of UMD or the security of the project itself.
What Is Out of Scope
The following are generally not considered security vulnerabilities in the context of UMD:
Security Guidelines
Never share credentials
UMD does not collect, store, or transmit any of your credentials. Spotify and other platform tokens are stored locally only.
Review install scripts
Always review install.sh or install.bat before running. The scripts are open-source and available for inspection on Codeberg.
Keep dependencies updated
Run pip install -e . periodically to pull the latest secure versions of all dependencies, especially yt-dlp.
72-hour response SLA
We commit to acknowledging security reports within 72 hours and providing a fix timeline within 7 days for critical issues.
Coordinated disclosure
We ask that reporters give us at least 90 days to patch a vulnerability before public disclosure.
No bounty program
UMD is a solo open-source project. While we cannot offer monetary bounties, we will credit all responsible disclosures in the changelog.
Found something?
Report it responsibly. We read every report and respond to all legitimate security concerns.