From def293c62fcaa205bbb5bfb35a30c57667c8781d Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Thu, 20 Aug 2026 12:22:47 -0500 Subject: [PATCH 1/4] Add SECURITY.md with a private disclosure path --- SECURITY.md | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..c3eadee --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,44 @@ +# Security Policy + +## Supported Versions + +qBraid actively supports security updates for the most recent minor release of +`pyqasm`. Older minor versions receive fixes only where an issue is judged severe +and a straightforward backport exists. + +## Reporting a Vulnerability + +The qBraid team takes the security of our software seriously, across every repository in +this organization. We encourage responsible disclosure of any security vulnerability. + +### How to report + +Use GitHub's private security advisory form for this repository: + +[Report a security vulnerability](https://github.com/qBraid/pyqasm/security/advisories/new) + +Please **do not** report security vulnerabilities through public GitHub issues, pull +requests, or discussions. + +### Vulnerabilities in dependencies + +`pyqasm` reaches third-party quantum SDKs through optional extras. If you are reporting an +issue that originates in one of those upstream packages rather than in `pyqasm` itself, +please report it upstream as well, and tell us here so we can assess whether users are +exposed through a path this package creates and advise them accordingly. + +### What to expect + +- Acknowledgment of your report within two business days. +- An assessment of severity and scope, and a request for any further detail we need. +- Progress updates while we work on a fix. +- Notification when the issue is resolved, including the release carrying the fix, and + credit in the advisory unless you prefer otherwise. + +### What to include + +- The type of issue and its impact. +- The version of `pyqasm` affected, and the Python version and platform. +- Full paths of the source files involved, if known. +- Steps to reproduce, ideally a minimal example. +- Any proof-of-concept or exploit code you are willing to share. From 05b3bb15e93d64fdf4e387668a30ef3d0a09d2f4 Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Thu, 20 Aug 2026 13:00:52 -0500 Subject: [PATCH 2/4] Clarify supported version range per review --- SECURITY.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index c3eadee..7c80963 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,9 +2,12 @@ ## Supported Versions -qBraid actively supports security updates for the most recent minor release of -`pyqasm`. Older minor versions receive fixes only where an issue is judged severe -and a straightforward backport exists. +qBraid actively supports security updates for the latest minor release line of `pyqasm`: +the most recent `MAJOR.MINOR` version together with every patch release within it. For +example, if the current release is `1.2.3`, then `1.2.x` is supported and `1.1.x` is not. + +Older minor lines receive fixes only where an issue is judged severe and a straightforward +backport exists. ## Reporting a Vulnerability From 5876c5ece291a30d387c86e9218159446b1e0931 Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Thu, 20 Aug 2026 13:03:57 -0500 Subject: [PATCH 3/4] Widen dependency guidance to direct dependencies, not only extras --- SECURITY.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 7c80963..219f58f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -25,10 +25,10 @@ requests, or discussions. ### Vulnerabilities in dependencies -`pyqasm` reaches third-party quantum SDKs through optional extras. If you are reporting an -issue that originates in one of those upstream packages rather than in `pyqasm` itself, -please report it upstream as well, and tell us here so we can assess whether users are -exposed through a path this package creates and advise them accordingly. +If an issue originates in an upstream dependency rather than in `pyqasm` itself, whether a +direct dependency or one reached through an optional extra, please report it to that +project as well and tell us here. We will assess whether users are exposed through a path +this package creates, and advise them accordingly. ### What to expect From 0ff87392602ababf0dfdd8e4a3b4fdcdf3b7e501 Mon Sep 17 00:00:00 2001 From: TheGupta2012 Date: Fri, 21 Aug 2026 12:12:40 +0530 Subject: [PATCH 4/4] docs: add a changelog entry for the security policy Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 62492ba..b9a2af7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -29,6 +29,7 @@ Types of changes: ### Dependencies ### Other +- Added a `SECURITY.md` with a private vulnerability disclosure path. There was no documented way to report one, leaving a public issue or a guessed email address as the only options. Reports now go through this repository's GitHub security advisory form. ([#383](https://github.com/qBraid/pyqasm/pull/383)) ## Past Release Notes