# Security policy

qslib is pre-release research software. No version is currently supported as
a security-stable release.

## Reporting a vulnerability

Do not disclose a suspected vulnerability in a public issue. Use GitHub's
private vulnerability-reporting facility when it is available. If that
facility is unavailable, contact the repository owner through a private
channel shown on the repository profile and ask for a reporting address
without including exploit details.

Include the affected revision, platform, minimal reproduction, expected
impact, and whether the issue has been disclosed elsewhere. No fixed response
deadline is promised before 1.0.

Incorrect physical results, silent convention changes, malformed artifact
acceptance, unsafe foreign-memory access, and reproducibility failures may be
security or integrity issues when they can corrupt trusted workflows. Report
them privately when public reproduction could expose sensitive data or create
an exploitable condition.
