QSTriage is an early-stage, local-first security tool for cryptographic inventory review and post-quantum migration decision support.

QSTriage stops at the decision boundary. It does not modify production systems, rotate certificates, deploy cryptographic changes, or perform remediation.

Do not open a public GitHub issue for a sensitive security report.

Use GitHub's private vulnerability reporting for sensitive reports. If that channel is unavailable, contact the maintainer privately before sharing technical exploit details.

Do not include secrets, private keys, production inventories, customer data, credentials, access tokens, or confidential system diagrams in a report.

Security reports are most useful when they concern:

• unsafe parsing or handling of inventory, CBOM, or configuration input,
• policy, evidence, decision, or PDR behavior that could mislead a reviewer,
• PDR integrity verification or comparison that accepts an altered document,
• unsafe terminal, Markdown, or file-output behavior,
• dependency, workflow, packaging, or release-integrity weaknesses,
• documentation that encourages unsafe operational assumptions.

QSTriage is not a production scanner, certificate manager, deployment tool, or automated compliance oracle. Missing enterprise automation is product feedback, not a security vulnerability.

Security fixes are handled on the latest main branch and the most recent tagged release.

The repository uses:

• read-only default GitHub Actions permissions,
• immutable full-length action commit references,
• non-persistent checkout credentials and bounded job execution,
• hashed Python 3.11 application and release-tool locks,
• dependency auditing, Bandit analysis, and full-history Gitleaks scanning,
• Dependabot monitoring for Python and GitHub Actions,
• a weekly scheduled Security run; when it fails on main, a separate alert workflow with only issues: write opens or updates a tracking issue,
• repository rulesets: changes to main require a pull request, squash merge, and the required CI, security, and release checks; main cannot be deleted or force-pushed; release tags matching v* cannot be deleted or moved,
• reproducible wheel/source builds, SHA-256 manifests, and CycloneDX SBOMs.

GitHub-hosted provenance and SBOM attestations run only for eligible tag pushes or explicit exact-tag rebuilds in a public repository. Private-repository runs retain the reproducible release bundle and local integrity evidence without requesting attestation permissions.

Inventory, CBOM, configuration, and PDR files are untrusted input. QSTriage enforces size, structure, string, collection, simulation, and graph-work limits. YAML aliases are rejected. Limit violations fail explicitly rather than producing a partial decision result.

The exact supported input contract is documented in Input Contracts.

Supported CBOM parsing is bounded structural validation, not universal CycloneDX validation or proof of complete cryptographic discovery. See CBOM Compatibility.

File-backed PDR generation captures each source once and parses and hashes the same bytes. See PDR Contract.

PDR 0.3 hashes use the RFC 8785 canonical JSON form, so they can be recomputed with any RFC 8785 implementation. qstriage pdr verify recomputes the document hash, every record hash, and the run identifier, and checks that each record repeats the document provenance. It reads at most 64 MiB, rejects duplicate JSON keys and non-finite numbers, and never writes. qstriage pdr diff verifies both documents first and produces no comparison if either fails.

Verification shows that a document is internally consistent. It does not show who produced it or which registry and policy content were used; the recorded registry_hash and policy_pack_hash identify that content.

Generated files are no-clobber by default. --overwrite is required for an intentional replacement, but never permits writing through a symlink or replacing the active input/configuration file.

QSTriage publishes complete temporary output atomically and applies restrictive permissions where supported. Terminal and Markdown presentation boundaries neutralize user-controlled control sequences, markup, and raw HTML while preserving the supplied value as visible text.

Use only data you are authorized to process. Prefer sanitized inventories and examples when testing or reporting an issue. Detailed command behavior is documented in the Usage Guide.