directors-cut

The core server logic (app.py, src/server.py) uses `json.loads` for parsing JSON inputs and constructs `subprocess.run` commands with lists of arguments, which mitigates common command injection vulnerabilities. API keys (Gemini, ElevenLabs, Nebius) are correctly loaded from environment variables. File paths are constructed using `os.path.join` to prevent path traversal. A test script (`verify_workflow.py`) contains an `eval()` call, which is a security risk if exposed to untrusted input, but it is isolated to a test context. Network requests to various AI APIs are expected for functionality but depend on external service security. YouTube download features may encounter network restrictions on certain deployment platforms (e.g., Hugging Face Spaces), requiring proxies or cookie workarounds.