Report a vulnerability

If you have found a potential security threat, vulnerability or exploit in Quasar or one of its official packages, please:

• DON’T create a pull-request
• DON’T file a public issue on GitHub
• DON’T mention it on Discord and
• DON’T create a forum thread

Any public disclosure — even a well-intentioned one — gives attackers a head start before a fix can be released.

DO report it privately through GitHub’s private vulnerability reporting. On the repository hosting the affected package, open the Security tab and hit Report a vulnerability. The report is visible only to you and the Quasar team; we will work with you there to triage the issue, prepare a fix and, where appropriate, publish a security advisory crediting your finding. At the current time we do not have the financial ability to reward bounties, but in extreme cases will at our discretion consider a reward.

Pick the right repository

A report is only visible to the maintainers of the repository it is filed against, so please file it where the affected code actually lives:

• Quasar framework packages — quasar (Quasar UI), @quasar/app-vite, @quasar/cli, @quasar/vite-plugin, @quasar/extras, @quasar/icongenie, create-quasar and every other package developed in the main monorepo: report it on quasarframework/quasar.
• Official App Extensions and UI kits — @quasar/testing-*, @quasar/apollo, @quasar/qcalendar, @quasar/qmarkdown and friends each live in their own repository under the quasarframework organization: report through the Security tab of that specific repository. You can find each extension’s repository linked on the Discover App Extensions page.
• Community App Extensions are maintained by their respective authors, not by the Quasar team, so reach out through the security reporting channel of that extension’s own repository.

If the vulnerability lies in one of Quasar’s upstream dependencies, report it to that project directly. Should you be unsure whether or how it affects Quasar itself, file a private report with us as described above and we will help triage it and report it upstream if appropriate.