Vulnerability Response

Report and validate security defects without disclosing sensitive details publicly

Use the security reporting instructions in the QQQ repository. Include the affected version and a minimal reproduction, with credentials and application data removed. Do not assume an unverified security mailbox is monitored.

For a deployed application, identify exposure, choose a tested patch or mitigation, and verify the exact replacement artifact and affected operation. Track the dependency/runtime versions and the remaining remediation. Follow your organization incident process for notification and access changes.