Found a security problem? Please tell us.

• Anything sensitive (a vulnerability, exposed data, or an account or access issue): report it privately. Email app@q-summit.com, or use GitHub's private "Report a vulnerability" button on this repository. Please do not put sensitive details in a public issue.
• General security questions or hardening ideas: open a normal issue.

We aim to reply within 5 working days, keep you updated while we work on a fix, and credit you when it is resolved unless you prefer to stay anonymous.

The platform is designed to handle attendee and partner data. Reports about personal data, login, and access control matter most. Useful reports include impact, steps to reproduce, and affected versions or files.

For how personal data is handled and what a self-hosting deployer is responsible for, see PRIVACY.md.