pqctl is alpha software. Do not use it to protect production secrets yet.

Please do not open a public GitHub issue for security vulnerabilities.

Report privately via GitHub Security Advisories or email ryan.cuff@icloud.com.

We aim to respond within 72 hours.

• Cryptographic correctness issues (wrong algorithm, broken signing, decryption failures)
• Key material exposure or leakage
• Any issue that could compromise user key files

• Issues in upstream libraries (report to Cloudflare CIRCL or spf13/cobra)
• Feature requests