Please do not file public GitHub issues for security vulnerabilities.
Email <<SECURITY_EMAIL>> with:
- A description of the vulnerability and its potential impact.
- Steps to reproduce or a proof-of-concept (if safe to share).
- Any suggested mitigations you have in mind.
We will acknowledge your report within 14 days and keep you updated on remediation progress. We follow responsible-disclosure practices: we ask that you allow us reasonable time to address the issue before public disclosure.
| Version | Supported |
|---|---|
main (v0.1 alpha) |
✅ security fixes go to main only |
| older tags | ❌ no backports until v1.0 is released |
quench is in alpha (v0.1). There is no stable release yet. Security fixes
are applied to main; we will cut a patch release as needed. Backport support
to older tags begins at v1.0.
- Vulnerabilities in quench's Python package code that could compromise a caller's system, data, or credentials when quench is used as documented.
- Credential leakage via log output, run manifests, or artifact bundles.
- Path traversal or arbitrary file write via CLI arguments.
The tool sandbox (WBS §6) is NOT a security boundary at v0.1.
Per the risk table in docs/_source/wbs-v3.md §8, the tool sandbox is
intended for development and controlled training use only. Running untrusted
third-party tool code through quench is explicitly out of scope at this
version. Do not run untrusted tool implementations in a security-sensitive
environment.
The following are also out of scope:
- Security of the AWS account or IAM policies that quench operates under (that is the operator's responsibility).
- Vulnerabilities introduced by dependencies not directly maintained by this project (report those upstream).
- Social-engineering or phishing attacks against maintainers.
See docs/THREAT_MODEL.md for a summary of the threat model and known gaps at v0.1.