Security & Trust
Everything a security or procurement review needs, published. Every claim on this page links to an artefact you can check yourself.
At a glance
- No telemetry. The decoder, plugin and Workbench send nothing to QECTOR: no usage data, syndromes, matrices or circuits.
- Air-gapped licensing. Licence tokens are Ed25519 signatures verified offline against a key in the package. No licence server, no activation call.
- Verified builds. All 18 decoder wheels are built in GitHub Actions, carry Sigstore build provenance and PEP 740 attestations, and are published with Trusted Publishing (no API token).
- Tested before release. Each wheel is installed on its own OS and checked against the syndrome before publishing; the receipts ship as
platform-proof.json. - Dependency gate. Releases are blocked while a RustSec advisory or licence-policy violation is open.
Verify a decoder wheel
Download from PyPI or the v1.0.1 GitHub release, then check its checksum and provenance with the GitHub CLI:
sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify qector_decoder_v3-1.0.1-*.whl \
--repo GuillaumeLessard/qector-decoderPyPI also shows each file's attestations under "Verified details".
Verify the Claude plugin
The plugin v2.0.1 release ships SHA256SUMS, an Ed25519 signature over it, an SPDX 2.3 SBOM, a release manifest and provenance. Verify with the release-signing public key:
sha256sum -c SHA256SUMS
python scripts/sign_release.py --verify . \
--pubkey kYwkMApz4zMgQmJsOya1UZuByvnuikzlxQkQiA8NOJg=Every Python dependency of the plugin is pinned by SHA-256 in requirements.lock and installed with --require-hashes.
Public keys
| Key | Value |
|---|---|
| Plugin release signing (Ed25519, raw base64) | kYwkMApz4zMgQmJsOya1UZuByvnuikzlxQkQiA8NOJg= |
| Decoder licence verification (Ed25519, SPKI DER base64) | MCowBQYDK2VwAyEAQh9t19EZ4KWZEYjY3EwHCUzUIehZBlovaMtrpLQXeGA= |
The licence key is embedded in the package; it only verifies tokens and cannot issue them.
Data handling
We hold only purchase and licence records (organisation, e-mail, plan, receipt, token) and support messages. Card data stays with Stripe. Details, providers and retention are in the Privacy Policy, written for Québec's Law 25.
Revoked licences are published at qector.store/stripe/revoked.txt; air-gapped sites can copy it to ~/.qector/revoked.txt.
Report a vulnerability
E-mail [email protected] with the subject [SECURITY] QECTOR disclosure. Include the component, version, platform, reproduction steps and impact. Please do not publish details before a fix is available.
We acknowledge reports within 5 business days and coordinate disclosure with you. Supported versions: decoder 1.0.x and Claude plugin 2.0.x. Full policy: decoder SECURITY.md, plugin SECURITY.md, and security.txt.
Procurement
- Seller: Guillaume Lessard, sole proprietor trading as iD01t Productions, 2004 De Lorimier, Longueuil, Québec, Canada J4K 3H7.
- Contract: the Commercial Licence Agreement (français); Enterprise deals use a signed agreement.
- Payment: card or invoice through Stripe, in USD; tax numbers accepted at checkout.
- On request: W-8BEN for US customers, completed security questionnaires, and a call with the developer. Write to [email protected].