If you find a real vulnerability, please open a private GitHub Security Advisory or email the maintainer via GitHub.
Do not open a public issue for sensitive reports.
plugins/youtube includes Google-looking API keys used by YouTube's own
InnerTube clients (WEB / ANDROID / IOS).
These are public client identifiers, not private secrets:
- They ship inside the official YouTube apps and website
- They are used by many open-source extractors (e.g. yt-dlp)
- They cannot be used as a personal Google Cloud credential for billing abuse in the same way a private GCP key would
GitHub secret scanning may flag them as google_api_key. That alert is a
false positive for this project. Resolve those alerts as false positive;
do not rotate them as if they were private keys.
Never commit:
- Personal Google Cloud / Firebase private API keys
- GitHub tokens, npm tokens, cloud credentials
- Private cookies / session tokens for logged-in scraping