Quorum Auth handles authorization evidence and cryptographic proofs. Please report suspected vulnerabilities privately rather than opening a public issue with exploit details.

Until a dedicated security mailbox is configured, report a vulnerability to the repository maintainers through the private security-reporting mechanism of the hosting platform. Include the affected version, a minimal reproduction, the expected and observed behavior, security impact, and any suggested mitigation. Do not include real credentials, private keys, personal information, or production payloads.

Maintainers should acknowledge a report, reproduce it in an isolated environment, assess affected versions, and coordinate a fix and disclosure timeline with the reporter.

The core rejects unassigned participants, duplicate participant slots, unauthorized response types, duplicate responses, invalid challenges, invalid credential proofs, closed proposals, expired proposals, invalid token signatures, expired tokens, wrong audiences, payload mismatches, invalid issuers, and invalid or already-consumed resolutions.

The resolution-consumption guarantee depends on the adapter. MemoryAdapter is atomic only within one process. A production adapter must implement consumeResolution as an atomic durable operation.

The 0.1.0 challenge store is process-local. A multi-instance deployment must persist challenges through a future adapter extension or place challenge issuance and response verification in the same process. The core does not implement WebAuthn, OIDC, Ed25519, secp256k1, hardware keys, identity recovery, or revocation registries. Those belong to credential plugins.

The core cannot protect a participant whose credential is compromised. It cannot make an unsafe downstream action safe. Applications must enforce authorization at the execution boundary, compare the exact payload, use idempotency for irreversible operations, and apply their own access controls.

Changes involving canonicalization, proof envelopes, token claims, challenge handling, policy evaluation, adapters, or participant eligibility require regression tests and maintainer review. Cryptographic primitives should come from a well-reviewed provider and should not be reimplemented in application code.