Security Policy

Supported Versions

Only the latest version published on PyPI receives fixes. There's no separate long-term-support branch — if you're on an older version, upgrade before reporting an issue that might already be fixed.

Reporting a Vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Instead, email the maintainer directly: jtatopenn@libero.it

Include:

A description of the vulnerability and its potential impact
Steps to reproduce (a minimal script/circuit if applicable)
Which version(s) you've confirmed it on

This is a scientific-computing library (a quantum circuit simulator) rather than a network-facing service — the most relevant risk class is untrusted QASM/circuit input reaching code that shouldn't be reachable from it, or dependency vulnerabilities pulled in transitively. dense_evolution/parser.py evaluates QASM gate parameters and for-loop bounds through _eval_ast_node, an explicit AST node-type whitelist (no eval()/exec() anywhere in the codebase, confirmed via full-repo search) — this replaced a raw eval() call in v8.1.19, after a real code-execution vulnerability was found and fixed (attribute/dunder object-graph traversal bypassed the previous {'__builtins__': {}} restriction entirely; see the v8.1.19 changelog entry in README.md). If you find another way to make untrusted QASM/circuit input execute arbitrary code, that's exactly the kind of report this policy is for. Report anything that looks like it could do that, not just numerical correctness bugs (those belong in a regular issue instead).

You should expect an initial response within a few days. Since this is a single-maintainer project, please be patient — but security reports are prioritized over regular feature work.