Quirk Systems takes security seriously. We appreciate responsible disclosure and will work with you to investigate and address vulnerabilities.
Do not open a public issue. Instead:
- Email security@quirk.systems with a description, reproduction steps, and impact.
- Optionally, request our PGP key from the same address to encrypt sensitive details.
We will acknowledge your report within 72 hours and provide a status update within 7 days. We aim to ship a fix within 90 days of confirmation, depending on severity and complexity.
We follow a 90-day coordinated-disclosure window. We'll credit reporters in release notes unless anonymity is requested. Please give us reasonable time to ship a fix before public disclosure.
We support and patch the latest released version of each project. Older versions receive critical-severity fixes only.
| Version | Supported |
|---|---|
| latest | ✅ |
| older | critical fixes only |
- Vulnerabilities in third-party services or dependencies (please report upstream).
- Issues that require physical access or stolen credentials.
- Social engineering of staff.
- Denial of service through resource exhaustion against personal infrastructure.