Quantova builds post quantum infrastructure that holds real value and serves government, defence, and financial institutions. The security of that infrastructure and of the people who rely on it comes before everything else. This policy sets out the single authorised way to report a security weakness to Quantova and the commitments Quantova makes in return.

All security weaknesses must be reported privately through GitHub Private Vulnerability Reporting on the affected repository, under the Security tab, using Report a vulnerability. This opens a confidential advisory visible only to Quantova maintainers. No other channel is authorised for security matters.

Do not report a security weakness, and do not submit a fix for one, in a public issue, a public discussion, a pull request, a commit message, social media, or any other public place. A public report exposes every user of the network to the weakness before a fix exists. Any public submission that describes or fixes a security weakness will be closed and locked on sight and the reporter will be asked to resubmit through Private Vulnerability Reporting.

This policy covers the consensus engine QORUS, the virtual machine QVM, the Q Crypto library, the gateway, the Quanta contract language and compiler, the QCore software development kits, QStamp and the application software development kits, QNS, and the token standards QAsset and QCollectible. Weaknesses in how the approved cryptography is used are expressly in scope.

Quantova supports good faith security research. If you follow this policy, keep your testing within the rules below, and report what you find privately, Quantova will treat your research as authorised, will not pursue or support any legal action against you for it, and will work with you in good faith. This authorisation does not extend to anyone who acts outside this policy.

Security testing is permitted only against a build you run yourself in your own environment. Testing against the live Quantova network or any production system is never permitted and is not covered by the authorisation in this policy. Do not access, modify, copy, or retain data that is not yours. Do not degrade, disrupt, or deny service to others. Do not use social engineering, physical intrusion, or any attack on Quantova staff or third parties. Give Quantova a reasonable period to remediate before you disclose anything to anyone.

Quantova acknowledges every report within three business days. Quantova completes an initial assessment and assigns a severity within ten business days. Quantova keeps you informed of progress through the confidential advisory and agrees a remediation and disclosure timeline with you. Quantova credits reporters who wish to be named once a fix is released.

Quantova assesses severity using a recognised scoring method and remediates in order of severity. A critical weakness that can cause loss of value or a halt of consensus is treated as the highest priority. Where a weakness warrants a public identifier, Quantova requests a CVE and coordinates its publication with the fix.

Quantova practises coordinated disclosure. Details stay confidential until a fix is released and users have a reasonable window to upgrade. Quantova will agree a public disclosure date with the reporter and will not disclose earlier without cause.

Security fixes target the latest release of each repository. Older releases are not maintained and their published package versions are deprecated.

This policy follows the principles of ISO and IEC 29147 for vulnerability disclosure and ISO and IEC 30111 for vulnerability handling, and it aligns with the coordinated vulnerability disclosure guidance of CISA and the National Institute of Standards and Technology.

Use Private Vulnerability Reporting on the affected repository under the Security tab. This is the only authorised channel for any security matter. Do not open a public issue, a discussion, or a pull request about security, and do not post any message in public that even states a security matter exists. Private Vulnerability Reporting is enabled on every Quantova repository and is always available from the Security tab.