The latest tagged PaperQuant release is supported. The judging release is frozen; fixes are prepared on a separate branch until judging ends.

Please do not open a public issue for a vulnerability involving WebMCP tool authorization, paper-account integrity, sandbox escape, secret exposure, cross-session access, or artifact URL leakage. Contact Sourav Bera through the private contact method on the maintainer’s GitHub profile and include reproduction steps, impact, and any suggested mitigation.

• PaperQuant contains no real-money order path, withdrawals, private Binance endpoint, or exchange API-key form.
• Paper mutations require explicit user intent; reset requires a separate exact confirmation phrase.
• Financial mutations are idempotent.
• External market data and strategy labels are marked untrusted in WebMCP metadata.
• Hosted user Python fails closed with SANDBOX_POLICY until all automated sandbox gates pass.
• Deployment secrets belong only in Sites/Render secret stores.

Never include a real secret in a vulnerability report attachment.