If you believe you have found a security vulnerability in @quonfig/react, please report it privately so we can fix it before it becomes public.

Email: security@quonfig.com

Please include:

• A description of the issue and the impact you believe it has
• Steps to reproduce, or a proof-of-concept if available
• The version of @quonfig/react you tested against (npm ls @quonfig/react)
• Any relevant configuration (cloud vs. datadir mode, transport options)

We will acknowledge receipt within two business days and aim to provide an initial assessment within five business days. Please do not file a public GitHub issue, open a pull request that references the vulnerability, or disclose details on social media or chat until we have published a fix.

We patch the latest published 0.0.x release. Older versions are not actively maintained — if you are running one, please upgrade before reporting.

In scope:

• The published @quonfig/react package on npm
• Source in this repository (src/, scripts/, build/release config)

Out of scope:

• The Quonfig service itself (api-delivery, app-quonfig). Report those at the same address — they are tracked separately.
• Issues in transitive dependencies that are already disclosed upstream and patched in a newer version. Please open a regular issue or PR to bump the dependency.
• The underlying @quonfig/javascript SDK that this package wraps. Report those there using the same address.