VidGrabGitHubGet VidGrab
Security

The browser is treated as untrusted.

VidGrab assumes any web page could be hostile. Every boundary validates its own input and holds only the access it needs.

No localhost serverNo shellNo telemetryDRM refused
Threat model

What could go wrong, and what stops it.

RiskProtection
A web page tries to send VidGrab commandsOnly VidGrab's own extension can reach the app, through Chrome's native messaging. There is no local port to call.
A crafted link tries to run a commandTools run without a shell, the link always follows --, and only http and https links are accepted.
Another program reads your cookiesCookies never appear on the command line and are deleted from their private file when the job ends.
Another user on the Mac talks to VidGrabThe socket is private to your account, and the app checks the connecting user.
A tampered yt-dlp updateUpdates must come from yt-dlp's official releases and match the published checksum, or they are discarded.
Too much access to your DriveUploads can only see files VidGrab created; the library is read-only and limited to folders you choose.
Protections

Defence at every boundary.

Browser boundary

Only VidGrab's own extension can talk to the app, and every message is checked twice before anything runs.

Details
  • Native Messaging only, limited to one pinned extension ID
  • Every message validated twice: in the host, then again in the app
  • Only http and https links, with an 8 KB URL cap and a 1 MB message cap
  • Four allowed request headers; control characters are rejected

Running the engine

Downloads run with a fixed list of arguments. No shell, no outside config files, no surprises.

Details
  • Tools run with fixed argument lists, never through a shell
  • The link always follows --, so it can't be read as an option
  • --ignore-config blocks outside yt-dlp configuration files
  • A minimal environment, and tools from fixed locations, never $PATH

Cookies and secrets

Cookies are shared for one video, kept in a private file, and deleted when the job ends.

Details
  • Cookies are read only when you click Download, only for that video
  • They reach yt-dlp in a private 0600 file that's deleted when the job ends
  • Never on the command line, never saved with the queue
  • Google access tokens live in the Keychain, on this Mac only

Local connection

A private socket only your account can open, with the caller checked on every connection.

Details
  • Unix socket in a 0700 folder, with file mode 0600
  • The connecting process's user is checked with getpeereid
  • Length-prefixed messages with a hard size limit
  • The download queue is written atomically with mode 0600

Google sign-in

Sign-in uses PKCE in a private session and asks for the least Drive access each feature needs.

Details
  • Authorization code with PKCE and state, and no client secret
  • A private browser session for every sign-in
  • Least access: drive.file for uploads, read-only for the library
  • Granted permissions are checked before an account is saved

Supply chain and updates

Tools are pinned by checksum, and yt-dlp updates are verified before they replace anything.

Details
  • Bundled tools pinned by SHA-256 checksum
  • yt-dlp updates come only from its official releases, newer versions only
  • Each update must match its published checksum and report the right version
  • Updates swap in atomically, so a failed one changes nothing

Inside the browser

The Download button lives where page scripts can't reach it, and page text is never run as code.

Details
  • The video button lives in a closed shadow DOM pages can't reach
  • No eval and no innerHTML; page text is never parsed as HTML
  • Extension pages only run scripts shipped with the extension
  • Dependencies pinned exactly, with install scripts disabled

What VidGrab won't do

Some lines VidGrab doesn't cross, whatever the site.

Details
  • No analytics and no tracking
  • No local web server any page could call
  • No DRM bypass: protected services are refused
  • No access to Drive files outside the features you turn on
Tested

150 automated tests guard these rules.

The Swift test suite checks message validation, command building, cookie handling, the socket, sign-in, uploads, the Drive Library limits and the updater, including tampered and downgraded releases. The extension has its own suite. Every change runs both on GitHub Actions.

Under the hood

Every stream, split eight ways.

HLS \ DASH \ MP4 \ 4K \ M4A

Each video downloads as parallel fragments. If the connection drops, VidGrab asks what already arrived and carries on from there.

View sourceGet VidGrab