Scope
This policy covers the Quatm core runtime, the commercial platform, the web console, licensing components and the drivers distributed by the Quatm team. It describes how to report a suspected vulnerability and what you can expect from us in return.
Reporting a vulnerability
Please do not report security vulnerabilities through public GitHub issues or discussions. Send them privately to:
Encrypt the report with the current PGP key obtained from the same address when possible.
What to include
A useful report usually contains:
- the vulnerability type and affected components;
- the affected versions or commit;
- clear reproduction steps or a minimal proof of concept;
- the potential impact, such as data exposure, privilege escalation or denial of service;
- any suggested mitigation, if known;
- whether the issue is already public or under active exploitation.
Please remove credentials, personal data and sensitive laboratory information from logs and attachments before sending them.
Response process
| Stage | Timing | Action |
|---|---|---|
| Acknowledgement | within 24 hours | confirm receipt and assign a tracking reference |
| Initial assessment | within 3 business days | assess severity, scope and reproducibility |
| Remediation | depends on severity and complexity | develop, review and test a fix |
| Disclosure | after a fix is available | publish an advisory and updated release |
We will keep you informed of material changes to the assessment or timeline.
Coordinated disclosure
We follow coordinated disclosure. Reports remain private while we investigate and prepare a fix. When a fix is available, we publish an advisory and credit the reporter unless anonymity is requested.
We ask that you give us a reasonable opportunity to address the issue before sharing it publicly.
Safe harbour
We will not pursue legal action against researchers who act in good faith, follow this policy, avoid privacy violations and service disruption, and give us reasonable time to respond. This does not affect any rights or obligations under applicable law.
Out of scope
The following are generally outside this policy:
- vulnerabilities in third-party instruments, vendor SDKs or operating-system packages that Quatm does not control;
- laboratory network misconfiguration that is not caused by a Quatm default;
- social engineering and physical access attacks;
- reports requiring access to systems the reporter is not authorised to test.
If a report concerns a dependency, please also notify the upstream vendor.
Security guidance
- Keep Quatm on a supported release and review release notes for security fixes.
- Avoid development branches in production.
- Restrict control endpoints to trusted networks and use authenticated tunnels for remote access.
- Apply the principle of least privilege to service accounts and laboratory workstations.
- Review third-party drivers and SDKs before deploying them.
Contact
For security questions that are not vulnerability reports, write to security@quatm.com.