Security Policy

QCS takes the security of its services and of the people who use them seriously. If you believe you have found a security vulnerability in a QCS website, service, or repository, we would like to hear about it.

How to report

Please report vulnerabilities privately. Do not open a public GitHub issue, pull request, or discussion for a security problem.

• Use GitHub's private vulnerability reporting: report a vulnerability.

Where you can, please include:

• The affected URL, service, or repository
• A description of the issue and its potential impact
• Steps to reproduce, or a proof of concept
• How you would like to be credited, if at all

What to expect

• We will acknowledge your report and keep you informed as we investigate.
• We will let you know when the issue is fixed.
• With your permission, we are happy to credit you once a fix is released.

Scope

This policy covers websites and repositories operated by QCS, including info.qcloud.systems and qcloud.systems. Vulnerabilities in third-party platforms QCS depends on should be reported to those providers directly.

Good-faith research

We will not pursue action against anyone who researches and reports a vulnerability in good faith and in line with this policy. Please avoid privacy violations, data destruction, and service disruption, only interact with accounts you own or have permission to access, and give us a reasonable chance to fix the issue before disclosing it publicly.

A machine-readable version of this contact information is published at /.well-known/security.txt.