Quside builds quantum random number generation hardware that other people’s security depends on. That places a particular obligation on us: a weakness in an entropy source is not a cosmetic defect, it is a weakness in every key derived from it. We would rather hear about a problem from you than from a customer.
If you have found a security vulnerability in a Quside product, we want to know, and we will work with you to fix it. This policy explains how to tell us, what we will do, and what we ask of you in return.
This policy covers:
It does not cover:
Email security@quside.com.
Please include, as far as you have it:
Write in English, Spanish or Catalan. A partial report sent early is more useful to us than a complete one sent in a month.
Acknowledge — within 3 business days we will confirm we have your report and give you a reference.
Assess — we will validate the finding, determine which products and versions are affected, and assign a severity. Where we need more information, we will come back to you. Where we disagree with your assessment, we will tell you why rather than going quiet.
Keep you informed — we will send you a status update at least every 14 days while the report is open, and tell you when a fix is scheduled.
Remediate — we will develop and release a correction. Security updates for supported products are free of charge and always will be.
Disclose — we publish an advisory once a fix or mitigation is available, describing the vulnerability and what users should do. We will credit you by name unless you ask us not to. Where a CVE identifier is appropriate we will request one.
We aim to complete this within 90 days of your report. Hardware and silicon findings sometimes cannot be fixed on that timescale, and where a mitigation is the best available answer we will say so plainly rather than let the report age quietly. If we need longer, we will explain why and agree a revised date with you.
We ask that you give us a reasonable opportunity to fix a vulnerability before making it public, so that users have somewhere to go when they read about it. Our default is 90 days from your report, or the day the fix ships, whichever comes first.
If you believe users are at immediate risk and we are not moving fast enough, tell us. We would rather have that argument than have you publish without one.
If you follow this policy, we will treat your research as authorised, we will not pursue or support legal action against you in connection with it, and we will work with you if a third party raises a concern about your activity.
To stay within that commitment, please:
This is a statement of how we will act. It cannot override the rights of third parties or the requirements of law.
We do not currently operate a paid bug bounty programme. We acknowledge researchers publicly in our advisories, and we are glad to provide a written confirmation of a valid finding where that is useful to you.
Under Article 14 of Regulation (EU) 2024/2847 (the Cyber Resilience Act), we are required to report actively exploited vulnerabilities in our products to the designated national CSIRT and to ENISA, through the EU Single Reporting Platform. This applies from 11 September 2026.
To be clear about what that means for you: a vulnerability reported to us in good faith and not being exploited is not reportable to authorities. Vulnerabilities discovered through good-faith research, testing or disclosure are outside the mandatory reporting duty. If we do become aware that a reported vulnerability is being actively exploited, we will report it as we are required to, and we will tell you that we have done so.
Two things you should know:
If you license a Quside IP core and integrate it into your own product, you are the manufacturer of that finished product for CRA purposes, and the reporting and disclosure duties for it sit with you. When we find or receive a vulnerability affecting our block, we will inform you, remediate it, and supply the fix so that you can meet your own obligations. Our security contact is available to your team, not just to external researchers.
If you operate Quside hardware and want to be notified of advisories directly rather than reading them on our site, write to security@quside.com and we will add you to the notification list.
security@quside.com
Quside Technologies SL, Carrer Esteve Terradas, 1. Suite #304, Castelldefels, Barcelona 08860, Spain
For commercial, sales or general technical questions, please use our usual contact channels — this address is monitored for security reports only, and routing other traffic through it slows down the reports that matter.