Security policy

STATUS: v1.21.0-dev is a release candidate (NOT PUBLISHED). This policy describes how to report security issues in Q+ Language (compiler, VM, standard library, tooling and the AOT backend) and what you can expect. It does not announce a published release.

Reporting a vulnerability

Do not open a public issue for a security problem. Report privately to the maintainers:

• Security contact: security@TBD (placeholder — the public address will be added before publication; see MAINTAINERS.md).
• Alternative: contact the Maintainer 如东星瀚科技有限公司 (Rudong Xinghan Technology Co., Ltd.) through the channel published with the repository once the repository is public.

Please include:

• affected component (compiler qboot, VM bqvm, standard library, tooling, AOT backend, docs site/playground, editor components);
• affected version (VERSION value) and specification version (docs/qplus_language_spec.md header);
• a minimal reproducer (.q program, command line, and inputs/artifacts);
• impact assessment (crash, wrong code/value, sandbox escape, data exposure, denial of service, supply chain);
• platform (Linux x86-64 is the reference platform) and whether it reproduces on VM, AOT backend, or both;
• suggested fix/mitigation, if known.

Our process

1. Acknowledge within 72 hours (best effort).
2. Triage severity and affected versions; confirm the report and scope.
3. Fix and verify privately with tests where possible; prepare an advisory if warranted.
4. Coordinated disclosure after a fix is available and the Maintainer approves the disclosure timing. We will credit reporters unless they prefer otherwise.

Please do not disclose the issue publicly before coordination. Do not test against systems or data you do not own or have permission to test.

Scope

In scope: the language repository contents in this tree — compiler, VM, standard library, examples, tooling, AOT backend, docs site/playground, and optional editor components packaged with a release.

Out of scope: the closed-source 另一产品线 kernel and OS services (separate product line; report through its own channel), third-party services used for hosting, and issues in host toolchains (gcc, glibc, Python, VS Code) that are not caused by Q+ code.

Known limitations (not vulnerabilities)

Documented boundaries and residuals are known limitations, not security issues: unsupported AOT features fail loudly, async IO/threading are VM-only, Windows/ARM64 are development-line smoke targets, Modules B is incomplete, and the OS SDK is an external prototype. TSAN was not run in the current candidate — do not claim TSAN-clean/no data races. See ROADMAP.md and P0_RELEASE_CHECKLIST.md.

Safe harbor

We support good-faith security research on the open-source language tree. Do not access other users' data, do not run denial-of-service tests against shared infrastructure, and follow applicable law. We will not pursue legal action for good-faith research that follows this policy.