Note: Quacking is no longer under active development. There is no commitment to ship security fixes. The information below describes the original reporting channels in case a maintainer happens to pick a report up, but please assume responses may be slow or never come. For anything serious, the practical option is to fork and patch.

If you do want to report something, do it privately rather than opening a public issue.

The preferred channel is GitHub's private security advisory feature:

1. Go to https://github.com/abwagner/quacking/security/advisories/new
2. Describe the vulnerability, reproduction steps, and impact.

If you cannot use GitHub advisories, contact the original author through any contact info listed on the repository profile.

In scope:

• The Quacking framework code under src/quacking/.
• The benchmark runner under benchmarks/.
• Prompt-injection or jailbreak paths through the agent pipeline that could let a malicious specification cause unintended writes outside the target project directory.

Out of scope:

• Third-party dependencies (please report upstream).
• Issues that require the attacker to already control the user's Anthropic API key or local filesystem.