Security
pvdownloader is distributed outside the Microsoft Store and the Mac App Store, so you are the last line of verification. This page explains how to report problems, how to confirm that a download is genuine, and why your operating system may ask for confirmation before the first launch.
Reporting a vulnerability
If you discover a security vulnerability or a privacy concern, please report it privately rather than opening a public issue.
- Security contact: security@pvdownloader.com
- Acknowledgement target: within 48 hours
- Resolution or patch timeline: within 7 days
- Please include the version, platform, a description of the issue, and steps to reproduce.
We will credit reporters in the release notes unless you ask us not to. Please give us a reasonable opportunity to release a fix before disclosing the issue publicly.
In scope
- The pvdownloader desktop application and its installer.
- The update mechanism and the integrity of update manifests.
- Local privilege boundary issues, unsafe file handling, or path traversal in the download pipeline.
- Handling of the optional cookies.txt file, or of other sensitive local data.
- This website, including any way it could be used to distribute a tampered build.
Binary integrity & verification
Every official build is published through GitHub Releases. The SHA-256 digest of each file is listed on the Download page and on the release page. Download only from those channels, and verify before you run.
Windows (PowerShell or Command Prompt):
macOS and Linux:
Compare the output character by character with the digest published on the Download page. If it does not match, do not run the file — delete it and download again from the official release page.
Why is the build unsigned?
Signing for both platforms is subscription-based: Apple charges $99 per year for the Developer Program membership that notarization requires and has no free alternative, and a Windows code-signing certificate costs several hundred dollars a year plus a mandatory hardware token. pvdownloader is an independent project given away for free, so those certificates are not currently purchased. As a result, Windows SmartScreen and macOS Gatekeeper present a warning on first launch.
This warning indicates that the operating system does not recognise the publisher — it is not a virus alert, and it does not mean the file has been modified. You can confirm the file is genuine by checking its SHA-256 digest as described above.
Windows SmartScreen
- When Windows shows "Windows protected your PC", click the "More info" link.
- A "Run anyway" button appears. Click it to start the installer.
- Subsequent automatic background updates run without prompting.
macOS Gatekeeper
macOS blocks an unsigned download the first time it is opened, and the dialog it raises offers only “Move to Trash” and “Done” — there is no bypass inside it. The way past is in System Settings, which is also the procedure Apple documents for software that is neither notarized nor from an identified developer.
- Open the .pkg you downloaded for your Mac. macOS refuses. Dismiss the dialog with “Done”, not “Move to Trash”, which deletes the download.
- Open System Settings, go to Privacy & Security, and scroll to the Security section.
- Click “Open Anyway” next to the message about the installer, and confirm with your login password.
- Open the .pkg again. It runs, and macOS remembers the exception from then on.
If no “Open Anyway” button appears, macOS may not have registered the attempt. Open the .pkg once more and look in Privacy & Security straight afterwards.
If it still does not appear, you can clear the download flag yourself instead of waiting. Verify the SHA-256 first — this removes one of the protections standing between you and an unknown file — and then run this in Terminal, substituting the file you actually downloaded:
The Intel build has the same name with osx-x64. The command removes the “downloaded from the internet” marker macOS attaches to the file, which is what makes macOS run the notarisation check on it. Nothing else about the file changes.
Supply chain & third-party components
pvdownloader does not distribute yt-dlp, FFmpeg or aria2. They are optional components that you enable explicitly, and they are downloaded directly from their official distributions. pvdownloader also works with copies already installed on your system.
None of these components is modified, and none is linked into the application — each runs as a separate process. Component versions are recorded in the release notes, and their licenses are documented on the License page.
Because these components are obtained directly from their official distributions rather than redistributed by us, their licenses place no obligation, and create no liability, for pvdownloader. If you would prefer an LGPL build of FFmpeg, install it yourself and pvdownloader will use your system copy instead of downloading one.
Out of scope
Vulnerabilities in third-party components themselves (yt-dlp, FFmpeg, aria2, Avalonia, Velopack) should be reported to their respective maintainers. Content-related complaints — for example, "this tool can download my video" — are not security issues; pvdownloader hosts no content and downloads nothing on its own.