Please do not report security vulnerabilities in public issues, pull requests, Discord or other public channels.

Report them privately through GitHub: open this repository's Security tab and choose Report a vulnerability (https://github.com/QuilibriumNetwork/monorepo/security/advisories/new).

Please include:

• the affected component and the release or commit;
• what the issue is and what an attacker can do with it;
• steps or a proof of concept that reproduce it;
• a suggested fix, if you have one.

The node, qclient, the libraries under crates/, and the release and install tooling in this repository. Report issues in third-party dependencies to their maintainers, and tell us as well if Quilibrium is affected.

Security fixes go to the latest release of the current release branch.

We will acknowledge your report, work on the fix with you in a private advisory, and publish the advisory once the fix is released and deployed. Please keep the details private until then.