If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public issue.
2. Use the GitHub Security Advisory to report privately.
3. Include steps to reproduce, potential impact, and any suggested fixes.

We will acknowledge your report within 5 business days and work with you to resolve the issue.

This policy applies to the KaiOnCode/QuanTable repository.

QuanTable stores API keys in properties.env, which is gitignored. Never commit real API keys to the repository. The properties.env.example file contains only placeholder values.

The ReAct agent can execute shell commands, read/write files, and make network requests through its tool system. These tools are gated and should only be used in local development environments. Do not expose the agent terminal to untrusted networks.

The system generates financial analysis reports that may contain LLM-generated content. These reports are for research purposes only and should not be treated as investment advice.

Market data is fetched from third-party providers (Yahoo Finance, AkShare, Finnhub). API keys for these services are optional and stored locally. No user data is sent to third parties beyond standard LLM API calls.

QuanTable is an open-source research tool. We will never ask for cryptocurrency payments, wallet connections, or "verification" of any kind. The only official channel is this GitHub repository.

Please do not publicly disclose the vulnerability until we have released a fix. We will credit reporters in the release notes (unless you prefer anonymity).