NEXUS-Q v4.1.2 is the current release. Public status: “Audit-Ready Release. No production-readiness claim, no FIPS validation, external audit pending.” Release evidence is provided separately and must be checked against the exact tagged commit and artifact digests. Registry availability alone is not proof that every ecosystem package was built from the same Git commit.
Security fixes are developed against the active engineering baseline and backported only when maintainers judge the change safe and applicable. NEXUS-Q does not claim FIPS validation, Common Criteria certification, formal verification, or completion of an independent external security audit unless corresponding public evidence is linked from this repository.
Please report suspected vulnerabilities privately through the repository's GitHub Security Advisories / private vulnerability reporting mechanism when available. Do not disclose an unpatched vulnerability in a public issue.
Include, when safe to provide:
- affected commit, tag, or package version;
- affected component/API;
- reproduction or proof of concept;
- expected and observed behavior;
- security impact and prerequisites;
- any suggested mitigation.
Do not include production secrets, private keys, passwords, customer data, or other sensitive material in a report.
If private reporting is temporarily unavailable, open a minimal public issue requesting a private contact channel; do not publish exploit details there.
These are engineering targets, not contractual SLAs:
| Severity | Acknowledge | Triage target | Fix/release target |
|---|---|---|---|
| Critical | 2 business days | 5 business days | 14 calendar days |
| High | 3 business days | 10 business days | 30 calendar days |
| Medium | 5 business days | 15 business days | Next appropriate release |
| Low | 10 business days | 30 business days | Planned maintenance |
Targets may be extended when coordinated disclosure, upstream fixes, or reproduction requires additional time. The reason and current status should be recorded internally.
Changes are expected to preserve the repository security gates, including formatting, linting, tests, dependency auditing/denial checks, secret scanning, and the configured fuzzing gates. Main-branch fuzz soak is configured for 45 minutes per designated parser target; V2 development PRs use the shorter 5-minute smoke gate.
NEXUS-Q is software. The software backend does not provide hardware isolation from a compromised OS, kernel, hypervisor, or physical attacker. TPM/HSM/Secure Element support is an abstraction/future integration point unless a concrete provider is explicitly documented and tested.