Only the latest release published to npm is supported with security fixes.

Upgrade to the latest release before reporting a vulnerability.

Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities using GitHub Security Advisories:

https://github.com/quaid/quaid-scanner/security/advisories/new

You will need a GitHub account. The advisory form lets you describe the vulnerability privately before any public disclosure.

A useful report includes:

• Version affected — output of quaid-scanner --version
• Steps to reproduce — the exact commands or inputs that trigger the issue
• Impact — what an attacker could do, and under what conditions
• Suggested fix — optional, but appreciated if you have one

The more detail you provide, the faster we can respond.

• Triage: within 7 days of receiving the report
• Fix or mitigation: within 30 days of triage

If the timeline cannot be met, we will communicate that in the advisory thread.

The following are not treated as security vulnerabilities in this project:

• Theoretical vulnerabilities without a working proof of concept
• Vulnerabilities in dependencies — report those to the upstream project directly; we will update our dependencies when fixes are available
• Scanner false positives — quaid-scanner producing an incorrect finding is a bug, not a security issue; open a false positive issue instead

We follow coordinated disclosure. Once a fix is released, we will publish the advisory publicly and credit the reporter (unless you prefer to remain anonymous).