If you discover a security vulnerability in the Qwick Cert CLI, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, email security@qwickcert.com with:

• A description of the vulnerability.
• Steps to reproduce.
• The potential impact.

We will acknowledge your report within 48 hours and aim to provide a fix or mitigation within 7 days for critical issues.

• The CLI never stores long-lived Azure credentials on disk.
• Signing credentials are short-lived (issued per session, revoked immediately after use).
• API keys are scoped to specific permissions and can be revoked at any time.
• All communication with Qwick Cert servers uses HTTPS/TLS.
• Session tokens are stored in ~/.qwick/config.json with user-only file permissions.