A Quo has not made a stable release. Until it does, only the latest commit on the default branch receives security fixes.

Do not open a public issue containing an exploit, private key, credential, personal information, or recovery material. Use the repository's private security-advisory form.

Treat the project as experimental. Verification means that an artifact matches a signed statement and that the corresponding signature is valid. It does not mean the artifact is safe, reviewed, legal, current, or endorsed by A Quo.