This policy covers QECTOR repositories that do not have a SECURITY.md of their own. qector-decoder and qector-claude-plugin each have their own policy: follow those for those projects.

Please report privately, not in a public issue:

1. Open the affected repository on GitHub.
2. Go to the Security tab and choose Report a vulnerability.

Include the affected version or commit, the steps to reproduce, and the impact you expect. Reports are reviewed by the maintainer, and fixes are coordinated before any public disclosure.

An error in a paper, a proof or a dataset is not a security issue. Open a normal issue in the repository concerned, so the correction is public.