HTTPS and transport checks
Production HTTP traffic is redirected to HTTPS. Provider and proxy requests restrict cURL to HTTPS and enable certificate and hostname verification.
Security, privacy, and operational transparency
Security & Data Handling
This page documents the safeguards currently implemented when VideoDownloader.click receives a supported public media URL, requests provider results, and streams an eligible remote file. It also identifies third-party boundaries, known limitations, abuse controls, and the process for reporting a suspected vulnerability.
- Control review
- Lookup limit
- 30 per 10 minutes
- Proxy limit
- 12 per 10 minutes
- Result retention
- Up to 15 minutes
Evidence boundary for this security description
Verified in application code
Method and rate checks; HTTPS/domain validation; provider TLS settings; response size/type preparation; database query binding; SHA-256 cache keys; HMAC proxy signatures; public-IP/redirect checks; transfer limits; no-store runtime responses; browser-retention rules; consent gating; and offline-cache exclusions.
Deployment or vendor dependent
Production TLS termination and certificates, hosting access controls/log retention/backups, DNS, RapidAPI and lookup-provider controls, source platforms, remote media hosts, external interface resources, and consented analytics/advertising services.
Not claimed
No security certification, formal penetration-test result, bug bounty, vulnerability-free guarantee, end-to-end encryption claim, fixed incident-response time, uptime percentage, or complete contractual subprocessor register is represented here.
Review method: request endpoints, shared security helpers, database migration/test, configuration loading, server rules, service worker, consent loader, Privacy Policy, and public reporting routes checked July 28, 2026. This is a factual control description, not an independent audit.
Implemented safeguards at a glance
URL and host validation
URLs are length/format checked, require standard-port HTTPS, reject embedded credentials and IP-literal hosts, and must match configured source or media base domains.
Filtered provider results
Only cleaned metadata and up to 50 eligible media entries are prepared. Unsafe thumbnail/media hosts are omitted; provider HTML is not rendered as trusted page content.
Signed proxy requests
Eligible proxy links use a server-secret HMAC over the remote URL and expiry. Verification uses constant-time comparison and rejects changed, malformed, overlong, or expired requests.
Short application storage
The lookup cache uses a SHA-256 URL representation, a blank legacy plaintext-URL field, parameterized queries, filtered JSON, and an expiry of up to 15 minutes.
Abuse and resource limits
IP-derived rate buckets, provider timeouts/size checks, redirect limits, approved content types, download time/low-speed rules, and a 512 MB streaming cap bound common abuse paths.
Request and trust-boundary flow
- Browser to applicationThe browser POSTs the submitted public URL to the lookup endpoint. The endpoint returns JSON with
no-storeandnosniffheaders and accepts only the expected method. - Application validationThe server applies the lookup rate limit, validates URL structure and source hostname, checks required configuration/database access, calculates the cache key, and checks a non-expired row.
- Application to external providerOn a cache miss, the full URL is sent over verified HTTPS through RapidAPI to the configured media lookup provider. Automatic redirect following is disabled and the response is time/size/type constrained.
- Provider result preparationThe response must decode as structured data. Error states are handled; metadata is cleaned; media and thumbnails must match approved HTTPS media hosts; and no more than 50 entries are returned.
- Browser result and local storageThe browser renders content using DOM text operations, not provider HTML. A filtered result may be retained locally for about 15 minutes and recent history for up to seven days/50 items.
- Selected file deliveryThe browser requests an eligible remote host directly or uses a signed proxy. The proxy validates signature/expiry, resolves public IP addresses, checks each of up to three redirects, inspects type/size, then streams without intentionally storing the file.
Control matrix: protection, scope, and limit
| Control | Current implementation | Threat or failure reduced | Important limit |
|---|---|---|---|
| Source URL validation | HTTPS, port 443, valid URL, no embedded user/password, no IP-literal host, configured base-domain/subdomain match | Unsupported protocols, lookalike hosts, credential-bearing URLs, direct IP targets | Hostname acceptance does not prove that the path is one eligible public item |
| Provider transport | HTTPS-only cURL, peer/hostname verification, no automatic redirects, 10-second connect and 30-second overall timeout, 2 MB response limit | Plaintext provider transport, unchecked certificates, runaway waits, oversized lookup responses | RapidAPI/provider availability, account security, and internal retention remain vendor-controlled |
| Result filtering | Structured decoding, cleaned bounded text, approved thumbnail/media domains, at most 50 media entries, recognized audio/video/image types | Provider markup injection, unapproved destination hosts, unbounded result lists | Filtering cannot validate copyright ownership, source truth, codec compatibility, or provider accuracy |
| Proxy integrity | 15-minute HMAC-SHA-256 URL/expiry signature, 64-hex format check, constant-time comparison, expiry bounded to no more than 20 minutes ahead | Parameter tampering and indefinite reuse of a generated proxy request | The remote URL remains visible in the signed request; signing provides integrity, not secrecy |
| Proxy network checks | Approved HTTPS hosts, A/AAAA resolution, rejection if any address is private/reserved, manual revalidation of up to three redirects | Common server-side request-forgery paths and unsafe redirect changes | Application checks are one layer; hosting/network egress controls are deployment responsibilities |
| Transfer bounds | Type allowlist, 512 MB content/stream limit, 15-second connection, 120-second transfer, 20-second low-speed threshold, no redirects during body transfer | Unexpected content, oversized or stalled transfers, redirect changes after verification | Partial bytes may already reach the browser before a remote transport failure is known |
| Request rate limits | 30 lookups and 12 proxy requests per IP-derived bucket per 600-second window; excess receives HTTP 429 and Retry-After | Simple automated bursts and excessive provider/proxy use | Local file-backed limiting is not represented as a distributed WAF, bot-management, or DDoS service |
| Browser/runtime caching | Lookup/proxy responses use no-store; proxy response is private; the service worker bypasses all /ajax/ requests and caches only successful approved public navigation/static responses |
Application-managed offline reuse of submitted or remote runtime URLs | Browser history, downloaded files, hosting logs, and third-party records require separate controls |
Retention and deletion by location
| Location | Data | Current duration/control | Deletion boundary |
|---|---|---|---|
| Application database | SHA-256 URL key, blank legacy plaintext URL field, filtered provider response, expiry | Up to 15 minutes; expired rows are deleted during normal lookup activity | Automatic cleanup depends on subsequent normal requests; database operations/backups remain hosting concerns |
| Rate-limit state | SHA-256 bucket/IP key plus count and reset time in a permission-restricted temporary directory | 600-second logical window; old files may remain until system temporary-file cleanup | The file does not intentionally store the plaintext client address, but deterministic hashing is not anonymity |
| Browser result entries | Submitted-URL-derived local key, filtered result, timestamp | About 15 minutes when read; browser site-data controls remove it sooner | Removing browser data does not remove a server cache row or vendor record |
| Browser recent history | Submitted URL, public title, timestamp | Up to seven days and 50 items; Home Clear All removes this list | Clear All does not remove downloaded files, general browser history, consent, or every site-data entry |
| Generated proxy URL | Remote media URL, cleaned title, expiry, signature | Created for about 15 minutes and rejected after expiry | Do not share it; expiry does not erase copies from browser/network/infrastructure records |
| Application diagnostic output | Limited technical categories/errors where configured | No complete submitted URL or raw provider response is intentionally written by the current lookup code | Web server, hosting, DNS, security, and vendor logs have separate practices |
External services and responsibility boundaries
This operational inventory explains why a service can receive a request. It is not presented as a complete legal or contractual subprocessor register; consult the Privacy Policy and the provider policies for formal privacy information.
| Service category | Current role/data boundary | Activation | Responsibility limit |
|---|---|---|---|
| RapidAPI and configured lookup provider | Receives the full submitted public URL and normal request/network metadata when a fresh lookup is required | Required for non-cached media lookup | Provider security, processing, response accuracy, availability, and retention are external |
| Source platforms and remote media hosts | Control public access and media; receive normal network/referrer/request information during preview or file delivery | Required for source availability or selected file delivery | Audience, lifecycle, creator settings, hosting, media variants, and remote logging remain external |
| Website hosting, DNS, and infrastructure | Serve the application and may process IP addresses, request paths, timestamps, server logs, database storage, and backups | Required to operate the website | Administrative access, physical/network security, backup, and log-retention controls are deployment responsibilities |
| Interface resource providers | jQuery CDN may receive ordinary resource-request metadata on downloader routes that load it; interface fonts and icons are served from the site stylesheet | jQuery supports the downloader interface; fonts and icons are shared local interface resources | The CDN infrastructure and logs are external; future performance work may reduce this dependency |
| Google Analytics, Contentsquare, and Google AdSense | Optional measurement/experience/advertising scripts and associated browser/network data | Intentionally initialized only after the browser records an accepted optional-cookie choice | Declining prevents intentional initialization by this loader; an earlier accepted session cannot be retroactively unsent |
Secrets, files, logs, and browser protections
Configuration and repository boundaries
- Database credentials, provider key, proxy secret, optional media hosts, and site URL load from environment or an ignored local configuration file.
- The local configuration, environment files, application logs, and logs directory are ignored by Git.
- Apache rules deny direct access to configuration, environment, log, SQL, database, include, and test resources and disable directory listings.
- Production still requires correctly configured secrets, restricted file permissions, backups, updates, and administrative access outside this repository.
Browser-facing response protections
- Shared pages send
nosniff, same-origin framing, strict-origin-when-cross-origin referrer policy, and a restrictive camera/microphone/geolocation/payment/USB permissions policy. - Lookup and proxy runtime responses are marked no-store; proxy pages/files are noindex and the service worker bypasses every AJAX path.
- No Content Security Policy is currently represented as deployed. Adding and testing one remains separate work because current inline and external resources require deliberate migration.
- These headers reduce particular browser risks; they are not a replacement for input validation, secure deployment, dependency updates, monitoring, or independent testing.
Logging and report hygiene
- The current lookup endpoint does not intentionally write submitted URLs, raw provider responses, credentials, keys, signatures, or transport details to an application debug log.
- Visitors and researchers should redact private URLs, tokens, cookies, account identifiers, notifications, and unrelated browser tabs from support evidence.
- Hosting and external services may maintain their own access/security logs. Their retention and access controls cannot be inferred from application code.
- Operational logging must balance investigation value with data minimization and protection against unauthorized access or tampering.
Known assurance limits
- The rate limiter is local file-backed state, not a distributed denial-of-service protection service.
- SHA-256 cache/rate keys are deterministic representations, not encryption or anonymous data.
- Signed URLs detect modification and expire; they do not conceal the included remote URL from someone who receives the complete link.
- No page should be interpreted as proof of regulatory certification, formal security audit, or absence of vulnerabilities.
Coordinated reporting
Report a suspected security vulnerability
Send an initial private report to the current security contact. This mailbox is shared with the site operator and is not advertised as an encrypted reporting channel.
[email protected]Include in the report
- A concise vulnerability type and potential impact.
- The affected VideoDownloader.click URL or endpoint and date/time/timezone.
- Minimal reproducible steps using a non-sensitive test case.
- Relevant request/response headers with credentials, cookies, tokens, signatures, private URLs, and personal data removed.
- Your preferred contact and whether/how you would like credit if an advisory is later appropriate.
Testing boundaries
- Do not access, alter, retain, or disclose another person’s data or content.
- Do not perform denial-of-service, high-volume automation, spam, social engineering, physical testing, credential attacks, or persistence.
- Do not test source platforms, RapidAPI/provider systems, CDNs, hosting, DNS, advertising/analytics vendors, or other third parties through this policy.
- Stop after obtaining the minimum evidence needed and report privately before publishing details that could increase risk.
- This page does not create a bug bounty, promise payment, grant authorization outside systems controlled by the operator, or replace legal advice.
What happens next
- The operator will review the report when received and may request safe clarification or reproduction details.
- Reports are prioritized by reproducibility and potential impact; no fixed acknowledgement or remediation time is promised.
- Valid findings may require coordination with hosting or application vendors before remediation can be completed.
- Public credit or advisory details will be discussed when appropriate and only after the risk is addressed.
- Ordinary download failures, private-content requests, copyright matters, and layout problems should use Help or Contact instead.
Security standards context
Sources reviewed July 28, 2026. They inform the control descriptions and reporting process; their inclusion is not a certification of this implementation.