qataaum/SECURITY.md

Security Policy

Project Status

QATAAUM Quantum Assembly Runtime is currently in RESEARCH AND DEVELOPMENT phase. This is not production-ready software.

Supported Versions

Version	Status	Support
0.1.0-alpha	Development	Research only

Security Considerations

Clean-Room Development

This project follows strict clean-room development practices:

• ✅ All code based on public specifications only
• ✅ No proprietary IBM code or confidential information
• ✅ Independent implementation from original design
• ✅ Complete source provenance maintained

Known Limitations

This software is NOT production-ready:

• ⚠️ Research phase implementation
• ⚠️ Incomplete feature set
• ⚠️ Limited testing coverage
• ⚠️ No security audit performed
• ⚠️ No formal threat model yet

Quantum Computing Specific Risks

Quantum Circuit Execution:

• Circuits execute on quantum hardware or simulators
• Results may be non-deterministic
• Error rates depend on hardware
• No guarantees of correctness

Classical Control:

• IBM i integration requires proper access controls
• Job queues must be properly secured
• Execution receipts contain sensitive data

Reporting a Vulnerability

What to Report

Please report:

• Security vulnerabilities in code
• Clean-room boundary violations
• Improper use of proprietary information
• License compliance issues
• Unsafe code patterns
• Cryptographic weaknesses

How to Report

DO NOT open public issues for security vulnerabilities.

Instead:

1. Email: security@qataaum-project.org (when available)
2. Encrypted: Use PGP key (when available)
3. Private: Keep details confidential until patched

What to Include

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)
• Your contact information

Response Timeline

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 1 week
• Fix Timeline: Depends on severity
• Public Disclosure: After fix is available

Security Best Practices

For Users

DO:

• ✅ Review all code before use
• ✅ Understand quantum circuit behavior
• ✅ Validate execution receipts
• ✅ Use proper access controls
• ✅ Keep dependencies updated

DON'T:

• ❌ Use in production systems
• ❌ Execute untrusted circuits
• ❌ Share credentials
• ❌ Bypass verification checks
• ❌ Disable safety features

For Contributors

DO:

• ✅ Follow clean-room methodology
• ✅ Document all sources
• ✅ Write secure code
• ✅ Add tests for security features
• ✅ Review dependencies

DON'T:

• ❌ Copy proprietary code
• ❌ Use confidential information
• ❌ Introduce unsafe code
• ❌ Skip security reviews
• ❌ Commit secrets or credentials

Threat Model

In Scope

• Code execution vulnerabilities
• Input validation issues
• Memory safety violations
• Cryptographic weaknesses
• Access control bypasses
• Clean-room violations

Out of Scope (Currently)

• Physical quantum hardware attacks
• Side-channel attacks on quantum operations
• Quantum algorithm vulnerabilities
• Performance degradation attacks
• Social engineering

Dependencies

Security Scanning

We use:

• cargo audit for Rust dependencies
• Dependabot for automated updates
• Manual review of all dependencies

Dependency Policy

• ✅ Only use well-maintained crates
• ✅ Prefer crates with security audits
• ✅ Review all dependency updates
• ✅ No Python in production (by design)

Cryptographic Components

Current Use

• Execution receipt hashing (planned)
• Proof witness verification (planned)
• Deterministic replay verification (planned)

Standards

• Use standard cryptographic libraries
• No custom crypto implementations
• Follow NIST recommendations
• Document all cryptographic choices

Compliance

Clean-Room Compliance

All code must:

• Be based on public specifications
• Have documented source provenance
• Not contain proprietary information
• Pass clean-room review

License Compliance

• Apache 2.0 license
• Compatible dependencies only
• Proper attribution
• No license violations

Audit Trail

Source Provenance

See RESEARCH_LEDGER.md for complete source provenance.

Clean-Room Boundary

See CLEAN_ROOM_BOUNDARY.md for legal and ethical constraints.

Architecture Decisions

See ADRs/ directory for all architecture decisions.

Future Security Work

Planned

• Formal threat model
• Security audit
• Penetration testing
• Fuzzing infrastructure
• Static analysis integration
• Dynamic analysis tools
• Security documentation
• Incident response plan

Research Areas

• Quantum circuit validation
• Proof system security
• Receipt chain integrity
• IBM i security integration
• WASM sandbox security

Contact

Project: QATAAUM Quantum Assembly Runtime
Status: Research Phase
Security Contact: TBD
Website: TBD
Repository: TBD

Acknowledgments

We thank the security research community for their contributions to quantum computing security and clean-room development practices.

---

Last Updated: 2026-07-21
Version: 0.1.0-alpha
Status: Research Phase

Remember: This is research software. Do not use in production systems.