You might want to fix the XSS [1] on the page and prevent the path traversal (try typing ../config in download input)
[1] XSS Example: http://demo.youtransfer.io/download/%3Cscript%3Ealert(%27xss...
[1] XSS Example: http://demo.youtransfer.io/download/%3Cscript%3Ealert(%27xss...
I've created two issues on GitHub (https://github.com/remie/YouTransfer/issues/107, https://github.com/remie/YouTransfer/issues/108) which will be fixed in a new hotfix release asap.