This policy is executed by the Security Auditor agent (see
agents/security-auditor.md). The corresponding checklists and severity
scale live in docs/code_review_guide.md, Section 9.
Only the latest release receives security fixes:
| Version | Supported |
|---|---|
| Latest release (see CHANGELOG.md) | Yes |
| Older releases | No |
Please report suspected vulnerabilities privately through GitHub's vulnerability reporting (Security tab -> Report a vulnerability) so details stay confidential until a fix ships.
Please include:
- A description of the issue and its impact.
- Steps to reproduce, if possible.
- Any suggested fixes.
What happens next:
- Acknowledgement within 7 days.
- Assessment and, where applicable, a fix in the next PATCH release.
- Public disclosure after the fix ships, described in general terms.
This project discusses security topics in general terms only across its public artifacts (documentation, changelog, commit messages). Specific technical details are handled privately between the reporter and the maintainer until a fix is available.
QuantLab is a web application with a FastAPI backend and React frontend. It fetches market data from Yahoo Finance through yfinance over HTTPS, computes technical indicators, and runs backtests. It stores no credentials, executes no downloaded code, and runs as a local server.