Security

Audion VS Engine is an offline, portable video processing toolkit. It does not contact any network at runtime, does not require API keys, and processes only files you point it at.

Reporting

If you find a security issue (e.g. a crafted input file that triggers a crash with a clear path to RCE through one of the bundled native components), please open a private security advisory on the GitHub repo or email the maintainer privately rather than filing a public issue.

What ships in the bundle

The release archive includes third-party binaries resolved and pinned by the installer scripts at build time:

Latest stable VapourSynth at build time (BSD-3) and its plugins (varied licenses; see each plugin's repo)
Latest FFmpeg GPL/full build at build time: BtbN first, Gyan.dev full fallback (see ffmpeg licensing)
Embedded CPython 3.12.x (PSF License)
Portable PowerShell 7 (MIT)
Portable 7-Zip command-line tools (GNU LGPL / see bundled 7-Zip license)
fzf (MIT)

For VapourSynth R74+ wheel-layout builds, plugin autoload uses vapoursynth.get_plugin_dir() (Lib\site-packages\vapoursynth\plugins\ in the portable tree). The old system_core\vapoursynth\vs-plugins\ folder is legacy and must not be used as an install/status target.

The Audion-authored source code, scripts, launchers, presets, and documentation are licensed as GPL-3.0-or-later (see LICENSE).

Build reproducibility

builder_main.cmd and the install\Install-Portable-*.cmd family resolve "latest" components from upstream at build time (GitHub releases API for VS, python.org HEAD probing for CPython, BtbN/Gyan.dev for ffmpeg). Pin specific versions by passing the appropriate flags (e.g. Install-Portable-VapourSynth.cmd /R R76) if you need byte-stable rebuilds.

Do not commit secrets

This project has no notion of credentials and never asks for any. If you fork it for an extension that integrates a paid service, use environment variables and .gitignore rather than embedding keys in config/.