Until the first stable release, security fixes are applied to the latest released 0.x version only.

Do not open a public issue for a suspected vulnerability.

Use the repository's Security tab and select Report a vulnerability to submit a private GitHub security advisory. If private reporting is not available, contact Querit through the official support channel listed at querit.ai and request a private security channel.

Include the affected version, reproduction steps, expected impact, and any known workaround. Do not include real API Keys, raw user IP addresses, or production request data.

We will acknowledge the report, investigate it, and coordinate disclosure after a fix is available. Response timelines will be published here once the maintainers establish an operational security SLA.