Do not open a public issue. Report it privately through GitHub: Report a vulnerability.

Include what an attacker could do, the steps to reproduce it, and the Hazel version. You should hear back within a week. Please give us a reasonable time to ship a fix before disclosing it publicly; you will be credited in the release notes unless you prefer not to be.

• Anything that exposes saved sign-ins, cookies or downloaded files to other apps
• A link, file or web page that can make Hazel run code or write outside its folders
• APKs on GitHub or F-Droid that do not match the source
• Leaks of personal data, including over the network

Problems inside yt-dlp itself belong to the yt-dlp project.

Only the latest release gets fixes. Update before reporting.