Security fixes are provided for the latest published VoidCutter version.
Do not open a public issue for a vulnerability or suspected credential exposure. Use GitHub's private vulnerability report when available. Otherwise, contact the maintainer through the GitHub profile and arrange a private channel before sharing sensitive details.
Include only the minimum reproduction information. Never send a real API key, private transcript, provider response, project file, or confidential media.
VoidCutter does not contain a shared API key. Each user supplies a personal Gemini API key.
The key is stored through require("uxp").storage.secureStorage and is excluded from ordinary interface preferences, release files, diagnostics, and Git. Secure storage is a local credential cache; it does not protect against someone who already controls the operating-system account.
Replace or remove the saved key from VoidCutter Settings. If exposure is possible, revoke the key in Google AI Studio and create a new one.
| Tool | Provider request | Data used |
|---|---|---|
| Remove Silence | No | Local transcript timing and selected settings. |
| Remove Retakes | Yes | Task-specific transcript words, relative timing, selected settings, and user instruction. |
| Create Shorts | Yes | Task-specific transcript words, relative timing, selected settings, and user instruction. |
| Generate Metadata | Yes | Transcript text or word identifiers required by each generated block, plus tone and instruction. |
VoidCutter does not send raw audio or video, Premiere project files, project or sequence names, media paths, unrelated project metadata, or Custom Text metadata blocks.
Google processes Gemini requests under its own terms and privacy policies. Users are responsible for deciding whether a transcript is appropriate to send to the selected service.
Non-secret interface preferences and user-created presets use local storage. Transcript content, timing maps, prompts, provider responses, analysis results, and generated output are not intentionally persisted by the workflows.
Diagnostics are designed to contain stages, counts, durations, and sanitized error codes rather than credentials or transcript text. Do not publish console output without reviewing it for private information.