qBittorrent takes the security of our software seriously, including all source code repositories managed through our GitHub organisation. If you believe you have found a security vulnerability in qBittorrent, please report it to us as described below.

Please do not report security vulnerabilities through public GitHub issues. Instead, please use GitHubs private vulnerability reporting functionality associated to this repository. Additionally, you may email us with all security-related inquiries and notifications at security@qbittorrent.org.

Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:

1. Type of issue
2. Step-by-step instructions to reproduce the issue
3. Proof-of-concept or exploit code (if possible)
4. Potential impact of the issue, including how an attacker might exploit the issue

This information will help us triage your report more quickly. Any and all CVEs will be requested and issued through GitHubs private vulnerability reporting functionality, which will be published alongside the disclosure.

This security policy only applies to the most recent stable branch of qBittorrent. Flaws in old versions that are not present in the current stable branch will not be fixed.