How to report
Email [email protected] privately. Email is the only reporting channel supported by this policy.
Do not post suspected vulnerabilities, credentials, tokens, private device data, or exploit details in a public issue or pull request.
Include only what is needed to reproduce and assess the problem: the affected component and version, the steps, and the impact. Do not include unrelated user, device, account, or third-party proprietary data.
Scope
QC Remote accepts responsible security reports for its prerelease source, prerelease Windows and Android builds, and the Freevia-operated relay at qcrc.freevia.org.
In scope: the Windows and Android apps, the device broker, the local MCP endpoint and bridge, and the relay's pairing, OAuth, and command routing.
Out of scope: Neural DSP firmware and products should be reported to Neural DSP. Security issues in third-party AI apps connected to QC Remote should be reported to their publishers.
What to expect
Reports are acknowledged as resources permit; no fixed response time is promised. During prerelease, fixes may be included in a later test build or deployed to the relay. No public Windows or Android release is currently supported.
This page describes reporting policy only. It does not state that a particular app build, relay change, or security fix has been released.