Quarry is pre-1.0. Security fixes ship in a new patch release of the latest minor version; older versions do not receive backports. Upgrade to the latest release to pick up fixes.
| Version | Supported |
|---|---|
| Latest release | Yes |
| Older releases | No |
Report vulnerabilities privately. Do not open a public issue, pull request, or discussion for a suspected vulnerability.
- GitHub (preferred): report a vulnerability via private vulnerability reporting
- Email: contact@pithecene.sh
Include:
- Affected version (
quarry version) and component (CLI/runtime, executor, SDK, container image) - Description of the issue and its impact
- Reproduction steps or a proof of concept
- Any known mitigation
Confirmed vulnerabilities are fixed in a patch release and disclosed through
a GitHub Security Advisory and the release's CHANGELOG.md entry under
Security. Advisories in dependencies that have no fix yet are tracked in
SUPPORT.md § Open Security Advisories.