If you believe you have found a security issue in Quantum Runtime CLI, do not post exploit details in a public issue.

Use a private maintainer contact path when available. If no dedicated private channel is published yet, open a minimal public issue requesting a private disclosure path without including exploit details, secrets, or proof-of-exploit material.

Include:

• affected version
• impact summary
• reproduction conditions
• whether the issue affects local execution, report replay, artifact provenance, or dependency boundaries

Security reports are especially relevant for:

• unsafe command execution paths
• report replay trust bypasses
• artifact provenance spoofing
• dependency or packaging supply-chain issues
• accidental exposure of secrets or sensitive file paths

This project aims to acknowledge security reports promptly and coordinate a fix before detailed public disclosure when the report is valid and actionable.