Security fixes go into the latest release of qasight on PyPI and the main branch. Older versions are not patched; upgrade to the latest release.

Please do not open a public issue for a security problem.

Report it privately through GitHub: open the repository's Security tab and choose Report a vulnerability (direct link). Include what you found, how to reproduce it, and the version (qasight --version) or commit.

You can expect an acknowledgement within 7 days. Once the problem is confirmed, a fix is released and the advisory is published with credit to you, unless you prefer to stay anonymous.

In scope: the qasight CLI, the qasight engine, the FastAPI backend (qasight_api), the React frontend in frontend/, the GitHub Action and GitLab template, and the published runner image.

Areas that deserve particular care:

• Secrets in run artifacts. Failure evidence (tracebacks, log tails) is redacted before it is stored or sent to an AI provider. A way to get an API key, token or password past that redaction is a vulnerability.
• AI provider keys. Keys pasted on the AI settings page are kept in memory only. Anything that writes them to disk, logs or API responses is a vulnerability.
• API authentication. Bypassing the API's token checks, or running commands through the API without the required permission.

Out of scope: problems in the test suites QASight runs for you (they run with your permissions by design), and the deliberately broken demo app fake-api.