We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via one of the following methods:

• Email: security@quantsec.dev (if available) or open a private security advisory on GitHub
• GitHub Security Advisory: Use the "Report a vulnerability" button on the Security tab of this repository

When reporting a vulnerability, please include:

1. Description: A clear description of the vulnerability
2. Impact: The potential impact of the vulnerability
3. Steps to Reproduce: Detailed steps to reproduce the issue
4. Proof of Concept: If possible, include a proof of concept or exploit code
5. Suggested Fix: If you have a suggested fix, please include it

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution: Depends on severity and complexity

We follow a coordinated disclosure process:

1. Private Report: Security issues are reported privately
2. Investigation: We investigate and confirm the vulnerability
3. Fix Development: We develop and test a fix
4. Public Disclosure: After a fix is released, we publicly disclose the vulnerability

Timeline: We aim to disclose vulnerabilities within 90 days of initial report, or sooner if a patch is available.

1. Keep Dependencies Updated: Regularly update QuantSec SDK and its dependencies
2. Secure Key Storage: Never store private keys in plaintext. Use appropriate encryption and access controls
3. Validate Inputs: Always validate inputs before passing them to SDK functions
4. Handle Errors: Properly handle errors returned by SDK functions
5. Use Latest Versions: Use the latest stable version of the SDK

1. Review Code: All security-sensitive code is reviewed before merging
2. Dependency Audits: Regular dependency audits are performed
3. Security Testing: Security testing is performed as part of the development process
4. Documentation: Security considerations are documented in code and documentation

1. Unencrypted Key Storage: Identity::export() serializes private keys in plaintext. In production, implement encryption before serialization.

2. No Key Derivation: Key export/import does not use password-based key derivation. Implement PBKDF2 or similar for production use.

3. Memory Safety: While Rust provides memory safety, FFI boundaries require careful handling. All FFI functions are marked unsafe and should be used with caution.

4. Side-Channel Resistance: The current implementation does not explicitly protect against side-channel attacks. For high-security applications, consider additional protections.

5. No Forward Secrecy in Secure Channels: Current secure channel implementation uses long-term keys. For forward secrecy, implement ephemeral key exchange in both directions.

• Password-protected key export/import
• Hardware security module (HSM) support
• Side-channel attack resistance
• Forward secrecy in secure channels
• Key escrow and recovery mechanisms

For security-related questions or to report vulnerabilities:

• GitHub Security Advisory: Report a vulnerability
• Email: security@quantsec.dev (if available)

We thank security researchers who responsibly disclose vulnerabilities. Contributors will be acknowledged (with permission) in security advisories and release notes.

Current Status: v0.1.0-alpha has NOT undergone a formal security audit.

Recommendation: Do NOT use in production without a security audit for critical applications.

Future Plans: A formal security audit is planned before v1.0.0 release.

Last Updated: 2024-01-XX
Version: 0.1.0-alpha