Releases before 0.2.0 built SQL by string concatenation and should not be used with data that is not fully under your control. See the Security section of CHANGELOG.md.

Report privately through GitHub's security advisory form rather than as a public issue. Please include a minimal entity declaration and the sequence of calls that demonstrates the problem.

Expect an acknowledgement within a week. Since this is a spare-time project, please allow a reasonable window before public disclosure.

qDBManager assumes that:

• Values may be hostile. Entity fields, criteria operands and IN lists are bound as query parameters and never rendered into SQL text.
• Identifiers are not user input. Table and column names come from the entity declaration at compile time. They are still validated against QDBManager::isValidIdentifier() and quoted, so a caller that forwards user input into a column name or an ORDER BY argument is refused rather than silently executed.
• Raw SQL is the caller's responsibility. execute(), query<T>(), entityComplexQuery() and one_column_query() run the SQL they are given. Pass values through their bindings parameter; do not concatenate.

The library does not encrypt the database file and does not manage credentials. File permissions and at-rest encryption are the application's concern.