quantakrypto-tools is security tooling, so we hold the project to a high bar and welcome reports. This policy follows the spirit of ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling).

There are two consumption surfaces, versioned on two different schemes:

• npm packages (@quantakrypto/core, @quantakrypto/qscan, @quantakrypto/mcp, @quantakrypto/sieve, @quantakrypto/qprobe, @quantakrypto/agent) are pre-1.0, currently 0.5.x. Only the latest main is supported while the API stabilises, and we make no backward-compatibility promises before 1.0. Versioned support windows for the packages will be defined at the 1.0 release. The full policy is in docs/VERSIONING.md.
• GitHub Action is consumed through a moving major tag, uses: quantakrypto/pqc-tools/packages/action@v1. Pinning to @v1 is the supported way to run it in CI: the tag advances within its major to pick up fixes and does not carry breaking changes. That major line is independent of the action package's own pre-1.0 0.x version.

Security fixes are applied to the latest main and to the current v1 Action tag.

Please do not open public issues for security problems.

• Email security@quantakrypto.com (or the maintainers listed in package.json).
• Preferably use GitHub's private vulnerability reporting ("Report a vulnerability" on the Security tab).
• Include: affected package, version/commit, a reproduction, impact, and any suggested fix.

We aim to acknowledge within 3 business days and to provide a remediation plan within 10 business days. We will credit reporters who wish to be named.

These are developer tools that read source code and (for Sieve) drive an external implementation. The most security-relevant surfaces — documented in the security review — are:

• @quantakrypto/mcp HTTP transport (packages/mcp/src/http.ts). The hosted transport now enforces several controls in code: constant-time Bearer auth, per-request timeouts that abort the in-flight scan, a file/byte work budget (QUANTAKRYPTO_MCP_MAX_FILES / QUANTAKRYPTO_MCP_MAX_BYTES, each clamped to a hard cap), filesystem path confinement to a root allow-list (QUANTAKRYPTO_MCP_ROOT, rejecting .. traversal and out-of-root absolute paths), and Origin/Host validation to block DNS-rebinding. The scan_path / inventory_crypto tools still read the filesystem, so keep the transport loopback-bound and behind a token rather than exposing it publicly. The local stdio transport (npx @quantakrypto/mcp) runs on the developer's own machine and remains the recommended path.
• @quantakrypto/sieve runner (packages/sieve/src/runner.ts). It spawns a user-provided implementation. Only point it at code you trust; treat the SUT as you would any executable.
• @quantakrypto/qscan / @quantakrypto/core. Scanning untrusted repositories is generally safe (no code execution, symlinks are not followed), but see the ReDoS notes in the security audit before scanning adversarial inputs at scale.

Known issues and their remediations are tracked in docs/THREAT-MODEL.md (the boundary controls and their status). This file will be updated as those land.