Security policy

Supported versions

Security fixes target the latest published release.

Reporting a vulnerability

Report vulnerabilities privately through support@xquik.com.

Do not open public issues for secrets, credential handling defects, private data exposure, or package supply-chain concerns.

Maintainers acknowledge reports within 3 business days. We coordinate disclosure after confirming the issue.

Scope

Security-sensitive areas include API key handling, request construction, response parsing, dependencies, generated code, and release metadata.