QAuth is pre-1.0. Its releases are 0.x, and none has had an external security audit yet. That audit comes before 1.0 (ADR-018 §8).

Reports are welcome at every stage. A flaw found before 1.0 is far cheaper to fix than the same flaw found after it.

Report privately through the repository's private vulnerability reporting:

https://github.com/qauth-labs/qauth/security/advisories/new

Do not open a public issue, discussion or pull request with the details. If the private form is unavailable to you, open a public issue that only says you have a report and asks for a channel.

A report is easiest to act on when it names:

• the commit on main, or the release, you tested;
• the configuration in play, in particular any default-off switch you turned on: WALLET_FEDERATION_ENABLED, HYBRID_SIGNING_ENABLED, ID_JAG_ENABLED, or the CIMD_* settings;
• what the attacker controls at the start: an unauthenticated network position, a registered client, a user account, a wallet, a hosted document;
• a reproducer. A failing vitest test or a curl script against a local stack is ideal. A clear prose walkthrough is fine too.

docs/security/threat-model.md states what QAuth promises, where untrusted input enters, what is out of scope, and how severity is rated.

Reports produced by automated scanners, including AI-based ones, are welcome through the same private channel. The same rules apply to them:

• The report must carry a reproducer. A finding without one cannot be triaged.
• It is treated as unverified until a maintainer reproduces it.
• Severity is assigned by the maintainers against the threat model, not taken from the report.
• An unverified report is never published.
• A suggested patch is welcome. It is reviewed like any other change and needs a regression test.

QAuth is maintained by a small team. There is no on-call rotation, so these are realistic expectations, not a service-level agreement:

If you have heard nothing after 14 days, reply on the advisory thread. Silence is a dropped ball, not a policy.

main and the latest release line receive fixes. A fix lands on main first. When the latest release needs it before the next minor release, it is backported to that line's release branch and shipped as a patch release, as v0.1.1 was. Earlier lines receive no fixes. The 1.0 release will ship its own support policy.

We fix first, then publish a security advisory in this repository. The advisory names the affected versions, the fix and the reporter, unless the reporter prefers not to be named. The published advisories are listed at https://github.com/qauth-labs/qauth/security/advisories.