// Security
Security disclosure policy.
EigenOS Quantum is a small team with a focused threat model. We publish what we run, what we do not, and how to report a vulnerability.
Primary disclosure channel. Monitored 7 days per week.
Severity-tiered timelines below.
Researcher names listed with permission.
Threat model
EQL canonical hashes use SHA-256 with Ed25519 envelope. Vendor API keys AES-256-GCM at rest. Webhooks signed with Ed25519.
Supabase Auth with email and magic-link. Passwordless by default. Session cookies httpOnly, Secure, SameSite=Lax.
All traffic TLS 1.3. HSTS preload. CSP restricts script sources. CORS locked to eigenosquantum.com.
Single founder, single cloud region, no on-call rotation. Acknowledged. Paid tiers scale with Tier-B hosting partner.
Physical premises security. Side-channel on vendor hardware. QEC decoder attacks. Social engineering of founder.
Reporting timeline
| Severity | Acknowledge | Triage | Fix |
|---|---|---|---|
| Critical | 24h | 72h | 14d |
| High | 48h | 7d | 30d |
| Medium | 72h | 14d | 60d |
| Low | 5d | 30d | 90d |
// Report
Found a vulnerability?
Email security@eigenosquantum.com with a clear repro. We will acknowledge within 48 hours.