Please report security bugs to security@qutebrowser.org. (or if GPG encryption is desired, contact me@the-compiler.org with GPG ID 0x916EB0C8FD55A072).

Alternatively, report a vulnerability via GitHub's private reporting feature.