A review link is safe when four controls are on — password, expiry, watermark, and downloads off — and when your team treats "access ends when the round ends" as the default, not the exception. Pre-release cuts leak through the boring paths: a link forwarded beyond the client, a download that reappears somewhere public, a stale link nobody revoked after the project closed. None of these are solved by trust; they are solved by defaults. Here is the threat model and the control that answers each of it.
The four controls, honestly rated
| Control | What it stops | When to skip it |
|---|---|---|
| Password | Forwarded links — the URL alone stops working | Purely internal rounds; friction with no threat to answer |
| Expiry | Stale links found months later; the "old cut" leak | Never, on client links — there is no honest reason a link must live forever |
| Viewer-identified watermark | Screenshots and re-records — the leak carries its own receipt | Internal polish rounds where the frame is disposable |
| Downloads off | The file leaving as a file — the only control that addresses the master itself | Final delivery, where downloading is the point (keep the other three) |
The why watermark argument holds here: watermarks do not make leaks impossible, they make leaks traceable and not worth doing. Password plus expiry plus a viewer-named watermark changes the client's own forwarding behavior too — people handle watermarked, password-gated links more carefully precisely because the care is visible.
The threat model, mapped
- The forwarded link. Your contact shares the URL with a colleague, an agency, a spouse. Answered by: password (they share the context, not just the URL) and viewer-identified access so you know who is in.
- The screenshot. A frame of the unreleased cut on social media, source unknown. Answered by: the watermark — the leaked frame identifies the viewer who leaked it. Deterrence beats prevention here, and saying so is the honest position.
- The download-and-repost. The cut appears complete somewhere. Answered by: downloads off during review rounds — review tools stream; the file never has to leave. Enable downloads deliberately at delivery, with expiry still on.
- The stale link. Six months later, the rough cut with the temp music is one guessed URL away. Answered by: expiry set at round end, and an archive habit (the delivery checklist ends with exactly this step).
Unlisted YouTube links are not a review policy
Teams drift into it because it is free and plays anywhere. The honest comparison:
| Surface | Unlisted YouTube | Purpose-built review link |
|---|---|---|
| Access lifetime | Lives until you remember to delete it | Expiry you set per round |
| Who can watch | Anyone with the URL, forever, including re-sharers | Password/invite-gated, viewer-identified |
| Feedback | Comments are public-ish, not frame-pinned work tools | Frame-accurate comments, drawings, resolution |
| Watermark / identity | None on playback | Viewer-named watermark on the frame |
| Branding | YouTube chrome, related content, ads context | Clean, often brandable page |
| Re-encode control | YouTube's transcode, its compression choices | Your review preset; predictable quality |
Unlisted is fine for disposable internal memes. For a client's unreleased campaign it fails on every row a leak scenario cares about — and the compression row matters for feedback quality too, since reviewers end up critiquing YouTube's encode instead of your cut (the review export vs master problem, made worse by a third transcode you do not control).
Team defaults that make this automatic
- Internal links: expiry on, password off — the frame is disposable inside the team, and friction costs more than it protects.
- Client links: password, expiry, downloads off; watermark on anything embargoed or pre-launch.
- Press, festival and screener material: the strictest tier — named viewer, watermark, short expiry — the same discipline festival screeners have always used (what a screener is, and why watermarked screeners are the norm).
One honesty note: no review tool makes leaks impossible. Anyone with a screen recorder can re-record playback. The realistic goal is that every plausible path — forwarding, screenshots, downloads, stale links — is either gated, traceable, or closed, so that leaking requires effort and carries a receipt. That is what the four controls buy, and on Frooty, for example, all four are per-link settings on the share dialog; the secure video sharing surface and the review link vs email attachment post cover the surrounding mechanics.
FAQ
Are password-protected review links safe?
Safe enough for pre-release work when paired with expiry and downloads-off: the password kills casual URL forwarding, expiry closes the stale-link path, and disabled downloads keep the master from leaving as a file. No link-based system stops a determined screen recorder — watermarking exists precisely to make that path traceable instead.
How do I stop clients forwarding review links?
You cannot fully prevent re-shares, and any tool claiming otherwise is overselling. You can make forwarding useless: a password means the forwarded URL does not play, and a viewer-named watermark means any leaked frame identifies its source. Teams usually find client forwarding stops being a worry after the first password-gated round.
Should I use an unlisted YouTube link for client review?
For anything unreleased and client-owned, no: an unlisted video is watchable by anyone with the URL indefinitely, carries no viewer identity or watermark, adds YouTube's own encoding on top of your export, and wraps the review in platform chrome. It is acceptable for disposable internal clips, and poor for everything a review link is for.
Do review links expire?
On purpose-built tools, yes — expiry is a per-link setting, and the sane default is the end of the review round. Generic file links ( Drive shares, unlisted videos) generally persist until manually revoked, which is exactly how stale rough cuts resurface months later.