Fixes are released as a new patch version of the affected packages and binaries.

Do not report security problems in public issues, pull requests or discussions.

Email security@qrun.io with:

• what is affected (the CLI, qqq ui, a package, the installer or the packaging) and its version (the first line of qqq doctor);
• how to reproduce it, and what an attacker gains;
• whether the problem is in this client or in the QQQ server (server problems are handled through QRun-IO/qqq).

When private vulnerability reporting is enabled on this repository, you can also use Report a vulnerability.

We acknowledge reports within three business days, keep you informed while we fix it, and credit you in the advisory unless you ask us not to.

Things in scope include: how sign-ins and tokens are stored (OS keyring, the QQQ_KEYRING=file store), OAuth2 device and PKCE flows, handling of server-supplied file names and content, the curl installer and its checksum verification, and the release binaries.

qqq-dev-idp (in @qrun-io/qqq-ui-api-conformance) approves sign-ins without a password by design. It is for local development and tests only; running it where others can reach it is not a vulnerability in this project.

Dependabot watches the npm workspaces and the TUI's Bun lockfile (.github/dependabot.yml). Never commit secrets: use QQQ_TOKEN or the keyring, and keep tokens and private hostnames out of issues and logs you share.