QSL is research-stage software. No production security or supported-release assurance is established by this policy.

Do not publish exploit details, credentials, private data or sensitive logs in issues or pull requests. Use the affected repository's GitHub private vulnerability reporting facility when available.

If that facility is unavailable, the existing fallback is a minimal public issue stating that you need a private reporting route. Include no sensitive details. Wait for an appropriate private route before sending them.

• Affected repository, commit or release and environment.
• Expected and observed behavior, security impact and relevant assumptions.
• A minimal reproduction using synthetic data where possible.
• Any mitigations you have tested, clearly separated from guesses.

Shared project documents and community surfaces. Report component vulnerabilities to the affected repository.

We cannot promise a response time, remediation deadline, bounty or disclosure date through this document. Coordinate disclosure with maintainers through the private reporting route. A security policy is not evidence of an independent audit.