Quoll is distributed through the VS Code Marketplace and Open VSX. Security fixes are shipped only in a new published release, and only the latest published version is supported.

If you are affected, update to the latest release before reporting — the fix may already be published.

Please report security issues privately. Do not open a public issue, pull request, or discussion for anything security-sensitive.

Use GitHub's private vulnerability reporting for this repository:

1. Go to the Security tab of https://github.com/mtskf/quoll.
2. Choose Report a vulnerability.
3. Include a description, the affected version, reproduction steps, and the impact you observed.

This routes the report privately to the maintainer and lets us coordinate a fix and disclosure with you.

• Acknowledgement: within 7 days of your report.
• Assessment: an initial severity assessment and next steps within 14 days.
• Fix & disclosure: for confirmed issues, a fix is published in a new release and the advisory is disclosed once users have had a reasonable window to update.

We will keep you informed of progress and credit you in the advisory unless you ask us not to.

Quoll stores Markdown without content-based write admission, including unsafe URL destinations and incomplete or malformed frontmatter. Saving text does not authorize opening, loading, or executing it. Render, open, resource, image, and code-reference boundaries enforce their own policies, including permitted local resources and references; CSP remains default-deny. Advisory lint does not block writes.

This policy covers the published Quoll extension (VS Code Marketplace / Open VSX) at the latest release.

Unpublished, development, or self-built artifacts (a local pnpm build, an unreleased branch, a manually built .vsix) are not supported — unless the same defect also affects a published release, in which case report it as above and note that it reproduces on the release.