SECURITY.md - mozsearch

# Security policy

## Reporting a vulnerability

Report suspected security vulnerabilities in Qt by email to

<security@qt-project.org>. Do not report them in the public bug tracker at

bugreports.qt.io.

If you hold a commercial license, you can instead report the issue to the Qt

Company support team through the support portal, using the "Security Issues"

category.

## The policy

[QUIP 15](https://contribute.qt-project.org/quips/15) is the Qt Project

Security Policy. It is the authoritative source for how the project handles

security issues, and it covers:

* How reports are received, acknowledged, and triaged, and in what time frame.

* Who is responsible for addressing an issue, and how it is escalated.

* How issues are disclosed, including CVE handling and notification of

  packagers.

* Which versions of Qt fixes are guaranteed for.

Security announcements are published to the

[announce mailing list](https://lists.qt-project.org/listinfo/announce).

Qt customers with a commercial license now have the opportunity to subscribe to

the Qt Early Warning List in the [Customer Portal](https://account.qt.io/). The

EWL subscription requires an active

[Commercial Qt license](https://www.qt.io/development/qt-framework/commercial-qt).

## Related material

* [Security in Qt](https://doc.qt.io/qt-6/security.html) — what Qt does and

  does not protect against, and how to use Qt securely.

* [QUIP 23](https://contribute.qt-project.org/quips/23) — the `Qt-Security`

  header that marks how security-relevant a source file is.

* [QUIP 16](https://contribute.qt-project.org/quips/16) — the branch policy,

  which governs which branches accept which changes.

* [Coordinated Vulnerability Disclosure Policy](https://www.qt.io/terms-conditions/coordinated-vulnerability-disclosure-policy) -

  Terms and Conditions of Coordinated Vulnerability Disclosure Policy at Qt Group.