Please report security issues privately to support@quaply.com, not in public.
Include version or commit, reproduction steps, and impact (for example path escape or updater trust).
We aim to acknowledge reports within seven days.
In scope: the desktop app (IPC, path policy, crypto helpers), quap-mcp, and update signing when signed builds exist.