quicgate is a rolling release. Security fixes land on master and are published as a fresh ghcr.io/quicgate/quicgate:latest image. Always run the latest image; older image digests do not receive backported fixes.

Please do not open a public issue for security problems.

Report privately through GitHub's built-in flow:

1. Go to the Security tab of this repository.
2. Click Report a vulnerability.
3. Describe the issue, the impact, and steps to reproduce.

This opens a private advisory visible only to you and the maintainer. You'll get a response as soon as possible — this is a small hobby project, so please allow a few days.

If you cannot use the private reporting flow, open a normal issue that only says "security issue, please enable a private channel" (no details) and wait to be contacted.

Some things are deployment responsibilities rather than bugs: please keep them in mind before reporting:

• The admin UI/API (port 81) must never be exposed to the internet. Put it behind quicgate itself with an access list, a VPN, or a firewall rule. Treat a publicly reachable admin port as a misconfiguration, not a vulnerability.
• Change the default admin@example.com / changeme credentials on first run (the app forces the password change; set your own sign-in address under Account & security) and enable 2FA.
• quicgate ships hardened TLS defaults (AEAD-only cipher suites, configurable minimum version, HSTS) but the operator chooses what to expose.

Reports about the default credentials existing, or about the admin port being reachable in an intentionally-open test setup, are out of scope.

quicgate is reviewed from outside when somebody is willing to, and the results are public:

• September 2026, whole product (on 1.8.1): remediated in 1.9.0; the changelog lists every finding.

• 19 September 2026, the WireGuard work (on 1.17.1): twelve findings, five rated high, none an unauthenticated remote attack; all fixed in 1.17.2, each with a regression test. The record is in SPEC-wireguard.md, section 16, round 3. The fixes have not been reviewed from outside yet, which is why LAN access is still marked experimental.

• 27 September 2026, whole product with a functional check (on 1.17.5): a code review of every package, automated scanning, live probing, and a claim-by-claim check of the advertised features against real ACME, OpenID Connect, Docker and WireGuard test doubles. One finding rated high (behind a proxy that sends X-Forwarded-For as separate header lines, a client could choose its own address), twenty medium, the rest low or informational; none an unauthenticated remote attack. Twelve functional defects were found on the way, among them a TLS-terminating stream listener that restarted on every reload and a portal button that could never work. Everything is fixed in 1.18.0, each with a regression test. A review of the fixes before the release changed three of them: auto-ban counts refusals by address again (only what a browser was made to send for another site's page is left out), wrong passwords no longer lock an account (only wrong second-factor codes do, per account, and failures per network), and TCP streams keep the kernel's zero-copy path. The fixes have not been reviewed from outside yet.

A review is not a guarantee. If you find something, the section above says how to tell us, and we would rather hear it bluntly than not at all.