Report a vulnerability privately through GitHub's private vulnerability reporting:

https://github.com/ANcpLua/qyl/security/advisories/new

The report stays visible to the maintainers only until an advisory is published. Do not open a public issue or pull request for a security problem, and do not disclose details before a fix ships.

A useful report names the affected component (the Collector, the MCP server, a package, or the hosted service at mcp.qyl.at or api.qyl.at), the qyl version or commit, and the steps to reproduce it. qyl has one maintainer, so reports are triaged as time allows, without a guaranteed response window.

Fixes land on main and ship in the next release. Only the latest release line receives security fixes.

A confirmed vulnerability is disclosed in a GitHub Security Advisory on this repository once the fixed version is published.

The MCP server's trust boundaries are in docs/mcp/threat-model.md.