Monke Convert exists to process video files, and a video file is untrusted input: the demuxers that parse containers like MP4, MKV and MOV are a large body of C that has historically had exploitable memory-safety bugs. The app is built so that opening a malicious file is contained, and so that its own file operations cannot be turned against you.

Two things are treated as hostile:

1. The media file - its bytes, its container structure, and its metadata (title, comment, encoder, and other tags a file can carry arbitrary strings in).
2. The settings and history files on disk, in case another local process tampers with them.

When bubblewrap is available, ffmpeg and ffprobe run inside a namespace with:

• no network (--unshare-all),
• no capabilities (--cap-drop ALL, and no-new-privs),
• an empty environment (--clearenv), so no LD_PRELOAD and no inherited secrets,
• /usr read-only, the input file bound read-only, and only the output directory writable.

A file that exploits a demuxer bug therefore executes with no network, no privileges, and nothing to read or write except the one directory you're converting into. If bubblewrap is missing the app still runs, with a visible warning; you can also set the sandbox to always (refuse to convert without it) in Settings.

ffmpeg is always launched with an argument vector, never a shell string, so there is nothing for a crafted filename to inject into. Every path is passed as an absolute file: URL together with -protocol_whitelist file, which stops ffmpeg from interpreting a filename like concat:/etc/passwd|… or http://… as one of its pseudo-protocols. -nostdin keeps ffmpeg from consuming or blocking on standard input.

Deletion targets are resolved and must lie inside the current project directory; the final path component is deliberately not resolved, so a symlink is removed as a link rather than followed to whatever it points at. Deletion is trash-first and recoverable by default. A project root can never be a system directory or your home directory, and "delete the entire project" requires typing the project's name.

Every encode writes to an unpredictable temporary file and is atomically renamed onto its final name only on a clean exit. A crash, a cancellation, or a full disk leaves the temporary behind (and it is cleaned up) but never a truncated file masquerading as a finished render, and never an overwritten original.

Settings are JSON, validated field by field against allowlists - an unknown codec key, a relative binary path or an out-of-range value falls back to a default rather than reaching ffmpeg or exec. There is no pickle and no yaml.load. History is SQLite accessed exclusively through parameterised statements. Nothing is written world-readable; settings are 0600.

ffmpeg echoes file-controlled metadata into its log. That log is shown in a plain-text widget with ANSI and control characters stripped, and the two places in the UI that use rich text escape any file-derived string first, so a video whose title tag contains markup or a terminal escape sequence cannot act on your display.

Monke Convert makes no network connections: no update check, no telemetry, nothing.

Please open a security advisory or email the maintainer rather than filing a public issue. A description and, where possible, a sample file or reproduction steps are enormously helpful.