Security fixes are provided for the current release line only.

If you discover a security vulnerability or algorithmic integrity flaw in CQ-HECS, please do NOT create a public issue. Send a responsible disclosure report directly to: timfromhcs@gmail.com with the subject [SECURITY] CQ-HECS Vulnerability Report.

Please include:

1. Exact commit hash or release version (cq-hecs version).
2. Operating system and hardware environment.
3. Minimal reproducible proof-of-concept (a QASM circuit is sufficient).
4. Potential security or numerical divergence impact.

We aim to acknowledge a valid responsible disclosure within 7 days. This is a best-effort target for a single-maintainer project, not a service-level guarantee.