Responsible disclosure
Good-faith security reports help protect Qedix users. This policy explains the authorized channel, expected report content, research boundaries, and coordination process.
What this reporting process is intended to cover.
This policy does not grant access to private systems, customer repositories, internal environments, employee accounts, or third-party services.
A focused report helps Qohere evaluate the concern without unnecessary sensitive data.
A concise description of the suspected vulnerability and its potential impact.
The affected Qedix URL, workflow, or customer-visible component.
Clear reproduction steps using the minimum access and data necessary.
The date and approximate time of testing, including the relevant time zone.
Safe evidence such as sanitized screenshots, request details, or logs with credentials removed.
Your preferred contact information for coordinated follow-up.
Research must remain authorized, proportionate, and non-destructive.
Rule 01
Test only accounts, repositories, and information you own or are explicitly authorized to access.
Rule 02
Use the minimum number of requests and the least-invasive method needed to demonstrate the issue.
Rule 03
Do not access, retain, alter, destroy, or disclose another customer’s data.
Rule 04
Do not use social engineering, phishing, credential theft, physical intrusion, denial of service, or high-volume automated scanning.
Rule 05
Do not establish persistence, deploy malware, exfiltrate source code, or move beyond the minimum proof required.
Rule 06
Stop testing immediately if you encounter credentials, secrets, personal data, or customer repository content that you are not authorized to access.
Rule 07
Give Qohere a reasonable opportunity to investigate and address the issue before public disclosure.
Protecting customer information takes priority over continued testing.
If a credential belonging to you is exposed, revoke or rotate it promptly. Do not send the credential itself to Qohere.
The process may vary with severity, complexity, and affected parties.
Qohere reviews the report for sufficient information and confirms an appropriate contact channel.
The report is evaluated for reproducibility, affected scope, severity, and potential customer impact.
Qohere may request clarification, provide progress updates, and discuss a responsible disclosure timeline.
Where a valid issue is confirmed, Qohere works toward remediation and appropriate customer communication.
Response and remediation time depends on reproducibility, severity, technical complexity, customer impact, and required coordination. Qohere does not promise a fixed remediation deadline.
How Qohere intends to treat research that follows this policy.
This statement does not authorize unlawful activity, does not waive the rights of third parties, and cannot bind law-enforcement agencies or third-party service providers. If you are uncertain whether a test is permitted, contact Qohere before testing.
What reporters should expect from the current public beta.
Qohere does not currently operate a paid bug-bounty program and does not promise payment, public recognition, or other rewards. Any recognition is voluntary and requires the reporter’s consent.
Use a clear subject line so the report can be identified quickly.
Effective date: July 14, 2026. This policy may be updated as the Qedix security-reporting process evolves.
