Security Disclosure

How to Report

Email: [email protected]
PGP key: fingerprint posted on request. Reply to your initial email and we'll send the public key.
Acknowledgment: within 1 business hour during business hours; within 4 hours off-hours.
Initial triage: within 3 business days of acknowledgment.

Please include: a clear description, reproduction steps, observed vs expected behavior, and the impact assessment. We treat all reports as confidential until coordinated publication.

Safe Harbor

When conducting security research under this policy, we will not pursue legal action against you for the act of testing, provided that:

You make a good-faith effort to avoid privacy violations, data destruction, or service disruption.
You only interact with accounts you own or with explicit permission from the account holder.
You do not exploit a vulnerability beyond what is necessary to demonstrate it.
You give us a reasonable opportunity to remediate before public disclosure.
You do not violate any other applicable law.

We commit to working with researchers in good faith, providing timely triage, and crediting researchers (with consent) in the security advisory when a fix ships.

Cryptographic Posture

The service is built on the following primitives. Detailed parameter sets and module boundaries are in the Cryptography page.

Key establishment: X25519 ECDH + ML-KEM-1024 hybrid (FIPS 203 Category 5, 256-bit quantum security)
Symmetric encryption: AES-256-GCM, 96-bit nonces
Key derivation: HKDF-SHA-512
Signatures: ML-DSA-65 (FIPS 204)
Health gating: NIST SP 800-90B RCT and APT on every draw
Hash chain: SHA-256 for the audit provenance chain

Scope

In scope:

api.quantumsecuregateway.com endpoints (POST /v1/entropy, POST /v1/verify, GET /v1/audit/:id, GET /health, POST /auth/request-access)
Cryptographic implementation bugs in the worker module
Audit chain integrity bugs
Authentication and authorization flaws
Rate-limit and quota bypass

Out of scope:

Denial-of-service attacks (volume, resource exhaustion)
Social engineering against QSG staff
Physical attacks against QSG infrastructure
Findings from third-party services we do not operate (Cloudflare, IBM Quantum)
Self-XSS, missing security headers without demonstrable impact

Recognition

Researchers who report valid vulnerabilities and consent to attribution are listed in our security acknowledgments page. The first release of that page will be published once we have at least three independent researcher reports. Thank you for helping keep the service secure.

Full policy

Canonical machine-readable disclosure policy.

/.well-known/security.txt /security.txt