| Version | Supported |
|---|---|
| 0.5.x | ✅ |
| < 0.5 | ❌ |
If you discover a security vulnerability, please report it responsibly:
- Do NOT open a public GitHub issue
- Email hi@quantumai.kr with details
- Include steps to reproduce if possible
- We will respond within 48 hours
quant.cpp processes untrusted model files (GGUF). Known attack surfaces:
- GGUF parser (src/engine/tq_gguf.c) — malformed headers, oversized tensors
- Tokenizer (src/engine/tq_tokenizer.c) — malformed vocab data
- mmap handling — file size validation
We take buffer overflows and memory corruption seriously.