doom2quake both builds software and participates in security programs. We hold our own code to the same standard we apply as researchers.

Please report suspected vulnerabilities privately via GitHub Security Advisories on the affected repository, or by email to doom2quake@gmail.com. Do not open a public issue for a security report.

We aim to acknowledge within a few days and to coordinate a fix and disclosure timeline with you.

When we participate in bug-bounty programs, audit contests, and CTFs, we operate strictly within the published scope and rules of each program, practise responsible disclosure through the program's official channel, and never test systems we are not explicitly authorized to test.