Security fixes target the latest version on the main branch.

Do not open a public issue for a suspected vulnerability. Send the affected version, reproduction steps, and impact to contact@jesed.dev. Do not include real credentials, private keys, or sensitive files.

We will acknowledge the report, investigate it privately, and coordinate a fix and disclosure where appropriate.

Quanta runs entirely in the browser as a static site. It does not upload your keys, vaults, or passwords anywhere. It cannot protect against:

• A compromised browser, malicious extension, or malware on your device.
• Screen capture, keyloggers, or unsafe backups.
• Loss or exposure of the identity file (.qarmor-id) or passphrase.
• Brute-force attacks on a weak passphrase (choose a strong one; Quanta uses Argon2id with m=64MB, t=3, p=4).

Quanta uses post-quantum cryptography exclusively — ML-KEM-1024 key pairs and ChaCha20-Poly1305 AEAD via the Qarmor v3 envelope format. It has not been formally verified or independently audited. See also qarmor's security note.

Passkey-derived secrets rely on the WebAuthn PRF extension, which is supported by modern browsers and hardware authenticators. The PRF evaluation point is quanta-v3-webauthn-prf-input.