From b3c13f73e4a39f734547f907c00daacd00092c0a Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Thu, 20 Aug 2026 12:22:54 -0500 Subject: [PATCH 1/3] Add SECURITY.md with a private disclosure path --- SECURITY.md | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..e5efbb2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,44 @@ +# Security Policy + +## Supported Versions + +qBraid actively supports security updates for the most recent minor release of +`qbraid-algorithms`. Older minor versions receive fixes only where an issue is judged severe +and a straightforward backport exists. + +## Reporting a Vulnerability + +The qBraid team takes the security of our software seriously, across every repository in +this organization. We encourage responsible disclosure of any security vulnerability. + +### How to report + +Use GitHub's private security advisory form for this repository: + +[Report a security vulnerability](https://github.com/qBraid/qbraid-algorithms/security/advisories/new) + +Please **do not** report security vulnerabilities through public GitHub issues, pull +requests, or discussions. + +### Vulnerabilities in dependencies + +`qbraid-algorithms` reaches third-party quantum SDKs through optional extras. If you are reporting an +issue that originates in one of those upstream packages rather than in `qbraid-algorithms` itself, +please report it upstream as well, and tell us here so we can assess whether users are +exposed through a path this package creates and advise them accordingly. + +### What to expect + +- Acknowledgment of your report within two business days. +- An assessment of severity and scope, and a request for any further detail we need. +- Progress updates while we work on a fix. +- Notification when the issue is resolved, including the release carrying the fix, and + credit in the advisory unless you prefer otherwise. + +### What to include + +- The type of issue and its impact. +- The version of `qbraid-algorithms` affected, and the Python version and platform. +- Full paths of the source files involved, if known. +- Steps to reproduce, ideally a minimal example. +- Any proof-of-concept or exploit code you are willing to share. From 997f40a3779c3610ec43c29e9894e14fa085808f Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Thu, 20 Aug 2026 13:00:54 -0500 Subject: [PATCH 2/3] Clarify supported version range per review --- SECURITY.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index e5efbb2..772f017 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,9 +2,12 @@ ## Supported Versions -qBraid actively supports security updates for the most recent minor release of -`qbraid-algorithms`. Older minor versions receive fixes only where an issue is judged severe -and a straightforward backport exists. +qBraid actively supports security updates for the latest minor release line of `qbraid-algorithms`: +the most recent `MAJOR.MINOR` version together with every patch release within it. For +example, if the current release is `1.2.3`, then `1.2.x` is supported and `1.1.x` is not. + +Older minor lines receive fixes only where an issue is judged severe and a straightforward +backport exists. ## Reporting a Vulnerability From 7b94e941a3fa9af234e3aab936616254ab6d7828 Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Thu, 20 Aug 2026 13:04:00 -0500 Subject: [PATCH 3/3] Widen dependency guidance to direct dependencies, not only extras --- SECURITY.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 772f017..353a21b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -25,10 +25,10 @@ requests, or discussions. ### Vulnerabilities in dependencies -`qbraid-algorithms` reaches third-party quantum SDKs through optional extras. If you are reporting an -issue that originates in one of those upstream packages rather than in `qbraid-algorithms` itself, -please report it upstream as well, and tell us here so we can assess whether users are -exposed through a path this package creates and advise them accordingly. +If an issue originates in an upstream dependency rather than in `qbraid-algorithms` itself, whether a +direct dependency or one reached through an optional extra, please report it to that +project as well and tell us here. We will assess whether users are exposed through a path +this package creates, and advise them accordingly. ### What to expect