6 Comments

1. 

   Društvo on 4. November 2026. at 23:28

   It is interesting thing!
   Is there ay tutorial how to use your plug-in?

   Reply
   • 

     djordje on 4. November 2026. at 23:57

     Thanks for your comment! I haven’t made a tutorial yet, but that’s a good idea. The extension is straightforward to use, so feel free to give it a try in the meantime and let me know if you run into any questions.

     Lep pozdrav.

     Reply
     • 

       Društvo on 5. November 2026. at 22:42

       Hello,

       First, thank you for developing Multilingual Transcriber for Adobe Premiere Pro. I find your plugin very interesting, particularly because it supports Slovenian speech recognition and local transcription using Whisper.

       I would like to use it regularly for educational videos about Traditional Chinese Medicine, anatomy, acupuncture, and Tuina massage.

       Before installing version 1.0.4 on my main Windows computer, I had the installation package and its source files reviewed for potential security issues.

       The review did not identify obvious malicious code, but it highlighted several areas that may benefit from improvement.

       ### 1. Local API security – high priority

       In `apps/local-agent/src/api/server.py`, the FastAPI server currently uses:

       `allow_origins=[“*”]`

       The reviewed API routes also appear to lack authentication.

       Although the server binds to `127.0.0.1`, allowing requests from arbitrary origins may create unnecessary security risks.

       **Suggested improvements:**

       – Restrict CORS to explicitly authorized origins.
       – Implement authentication, such as a session-specific access token, for sensitive API operations.
       – Validate request origins and protect against unauthorized local requests.
       – Review and restrict filesystem operations exposed through the API.
       – Add automated security tests for unauthorized access attempts.

       ### 2. Verify downloaded components

       The Windows installer downloads several dependencies, including Python, pip, Faster-Whisper-XXL, and potentially 7-Zip.

       Some downloads are checked against expected file sizes, but I could not confirm consistent SHA-256 verification for all downloaded components.

       **Suggested improvements:**

       – Verify downloaded files against trusted SHA-256 checksums or digital signatures.
       – Pin dependencies to reviewed versions rather than automatically selecting the latest available release.
       – Reject downloads when integrity verification fails.
       – Consider digitally signing the Windows installer.

       ### 3. Minimize administrator privileges

       The installer requests administrator permissions and uses PowerShell with `-ExecutionPolicy Bypass`.

       I understand that some elevated permissions may be necessary to install the Adobe extension.

       However, I would appreciate an installation process that follows the principle of least privilege.

       Could you separate operations requiring administrator rights from those that can run under a standard user account?

       It would also be helpful to explain why execution-policy bypass is required.

       ### 4. Avoid forcibly closing Adobe Premiere Pro

       The Windows installation scripts contain commands that can terminate Premiere Pro processes using `Stop-Process -Force`.

       This could result in the loss of unsaved editing work.

       I suggest checking whether Premiere Pro is running and asking the user to save their project and close the application manually before continuing.

       ### 5. Clear privacy information

       One of the most attractive features of your plugin is local speech transcription.

       It would be helpful to provide clear documentation explaining:

       – Which operations are performed entirely on the user’s computer.
       – Whether any audio, video, transcripts, or metadata leave the computer.
       – Which internet connections are required for downloads and updates.
       – Whether cloud transcription services are completely optional.

       ### 6. Feature suggestions

       I would also like to suggest a few improvements that would make the plugin especially useful for educational video production:

       **Professional terminology dictionary**

       Allow users to define custom terminology, such as acupuncture-point names, anatomical terminology, and Traditional Chinese Medicine concepts, to improve transcription accuracy.

       **English-to-Slovenian translation**

       It would be extremely useful to automatically translate English subtitles into Slovenian while preserving their timing.

       **Improved subtitle formatting**

       Automatic sentence-aware segmentation, adjustable maximum characters per line, and convenient subtitle styling presets would be valuable additions.

       ### Final question

       Could you let me know whether you plan to address these security concerns in an upcoming release?

       I would be particularly interested in an updated version with authenticated local API access, verified downloads, and safer installation behavior.

       I would be happy to use your plugin once these issues have been addressed.

       Thank you for your work and for considering these suggestions.

       Best regards,

       Reply
       • 

         djordje on 5. November 2026. at 23:06

         Adding subtitle translation would require either a local model or a cloud service with ongoing costs. A local option like Qwen3 4B is about 2.5 GB, plus software to run it and preferably 16 GB RAM. It’s a fairly small model, though, and I haven’t tested whether its subtitle translations would be good enough. I don’t want users to have to pay for a cloud service.

         I could bundle Faster-Whisper, but its Windows package is about 1.4 GB to download, plus around 1.6 GB for the turbo model. That would make the download from my site too large. Redistribution may be possible, but I’d need to check the licenses of everything included.

         You can transcribe audio with Faster-Whisper without Premiere Pro. My extension exports audio from the active timeline and brings the resulting subtitles back into Premiere. That’s how I used to work, but the manual process was slow, which is why I made the extension.

         I can’t bypass Premiere Pro’s security restrictions. The extension works well on Windows; I haven’t received feedback from macOS users yet.

         Reply
         • 

           Društvo on 6. November 2026. at 23:26

           Hello,

           Thank you for your detailed response. I appreciate your explanation of the technical limitations, download sizes, and your intention to keep the extension free.

           I completely understand your decision not to bundle large AI models or require paid cloud services.

           My main concern, however, is still the security of the Windows installation and the local API.

           I would appreciate clarification on three specific points.

           1. Local API security

           The reviewed source code appears to configure FastAPI with allow_origins=[“*”], while some local API endpoints do not appear to require authentication.

           Could you clarify whether these endpoints are protected against unauthorized requests?

           Would it be possible to restrict allowed origins and introduce authentication or session-specific tokens for sensitive operations?

           I understand that Premiere Pro has its own security restrictions, but my question concerns the security of the local API implemented by your extension.

           2. Installer security

           Does the installer verify downloaded dependencies using trusted SHA-256 checksums or digital signatures?

           If not, would you consider adding these checks in a future version?

           I am particularly interested in ensuring that downloaded components have not been modified or replaced.

           3. Administrator privileges and Premiere Pro

           Could the installer avoid forcibly terminating Premiere Pro and instead ask the user to save their work and close the application manually?

           Could administrator privileges also be limited to operations where they are strictly necessary?

           My main question is whether you consider these security concerns valid and whether you plan to address them in a future release.

           I am not suggesting that your software is malicious. I simply want to ensure that it can be installed and used safely on my main Windows workstation.

           Your plugin is very useful, and I would genuinely like to use it regularly.

           Thank you again for your work and your time.

           Best regards

         • 

           djordje on 6. November 2026. at 23:41

           Thank you for the careful review. Your security concerns are valid.
           1. Local API: It listens on 127.0.0.1, but that alone is not sufficient. I plan to restrict allowed origins, add authentication to sensitive endpoints, and review filesystem access.
           2. Downloads: The installer does not consistently verify dependencies against trusted SHA-256 hashes or signatures. It would be possible to pin specific versions and verify each download against a trusted checksum or signature.
           3. Installation: I hadn’t encountered the forced-closure issue because I always closed Premiere Pro before testing. Thank you for pointing it out. The installer should ask users to save their work and close Premiere themselves. I’ll also review which steps actually need administrator privileges.
           I can’t promise an update release date. In the meantime, you can use Faster Whisper XXL as a standalone tool without my extension.

           Thannks.

This site uses Akismet to reduce spam. Learn how your comment data is processed.