Vulnerability Disclosure Policy
Last updated: 2026-10-12
HQS Quantum Simulations GmbH (“HQS”) welcomes reports of security vulnerabilities affecting our website, HQStage, and HQSpectrum service. If you believe you have found a security issue, please tell us so that we can investigate and address it.
Scope
This policy covers:
quantumsimulations.de and website content operated by HQS; and
The HQStage service cloud.quantumsimulations.de operated by HQS; and
the HQSpectrum web application and associated services operated by HQS.
A service’s inclusion in this policy does not authorize testing of infrastructure operated by third parties, other customers’ accounts, or systems that HQS does not control. If you are unsure whether a particular system or test is in scope, contact us before proceeding.
How to report a vulnerability
Send your report to security@quantumsimulations.de. Please include, where possible:
the affected URL, service, or component;
a description of the issue and its potential impact;
steps to reproduce it, using your own account or data where applicable; and
relevant screenshots, request details, or a minimal proof of concept.
Please do not send passwords, personal data, customer data, or other sensitive information unless it is strictly necessary to explain the issue. If sensitive material must be shared, ask us for a secure way to provide it.
Research guidelines
We ask that you act in good faith and:
Make only the requests necessary to confirm and explain the issue.
Use accounts and data you own or are expressly authorized to use.
Stop testing and report the issue promptly if you gain unintended access to another person’s data or account.
Avoid disrupting services, degrading performance, changing or deleting data, or affecting other users.
Do not perform denial-of-service testing, high-volume automated scanning, social engineering, phishing, physical security testing, or testing of third-party systems under this policy.
Do not exploit a vulnerability beyond what is necessary to demonstrate it.
Give us a reasonable opportunity to investigate and address the issue before publishing technical details. We welcome discussion with you about an appropriate disclosure timeline.
What you can expect from us
We will aim to acknowledge reports within five business days and will investigate credible reports as our resources allow. We may ask for additional information and will aim to keep you informed of meaningful progress. Investigation and remediation times will depend on the nature and severity of the issue.
If you have not received an acknowledgement after ten business days, please follow up using the same reporting channel.
Good-faith research
If you follow this policy and act in good faith, HQS will consider your research on the in-scope systems to be authorized by HQS. We will not pursue legal action against you for that research solely because it identified or demonstrated a vulnerability.
This commitment applies only to rights and claims that HQS controls. It does not authorize access to third-party systems or override applicable law. If you are uncertain whether an activity is permitted, please ask us before proceeding.
Recognition and discretionary payments
HQS does not operate a bug bounty program and does not promise compensation for vulnerability reports. After receiving and assessing a sufficiently detailed security report, HQS may, at its sole discretion, offer a modest payment or other form of recognition. Any such decision will be made case by case after disclosure of the issue to us. Submitting a report does not create an entitlement to payment, reimbursement, or recognition.
Please do not make disclosure of a security issue conditional on payment.