Security fixes are made on Quipu's default branch and included in the next release. Until a longer-term support policy is published, only the latest released version is supported.

Do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting for Quipu:

https://github.com/corelight/quipu/security/advisories/new

Include enough information to reproduce and assess the issue safely:

• the affected Quipu version and Linux distribution
• the expected and observed behavior
• the security impact and any known prerequisites
• minimal reproduction steps or a proof of concept
• relevant logs with secrets, private paths, rule content, and sample data removed

Do not attach live malware, customer data, proprietary rules, or credentials. The maintainers will coordinate validation, remediation, and disclosure with the reporter. No response or resolution time is guaranteed.

If you are unsure whether an issue has security impact, report it privately.