Security at QWED
QWED maintains public remediation guidance for disclosed security issues affecting released packages. When an issue is confirmed, we aim to validate the affected scope, ship a fix, publish version guidance, and preserve a clear record for downstream users and security reviewers.
Looking for the QWED Security GitHub App?
This page covers QWED's own security posture and package advisories. The QWED Security GitHub App is a separate product for PR and release verification.
Security advisories
Public vulnerability disclosures and remediation records
Review affected packages, fixed versions, remediation steps, and public references for QWED security advisories.
Authenticated Remote Code Execution via Unsafe SymPy parse_expr()
Unsafe SymPy parse_expr() Remote Code Execution via Unsanitized Math Expression Input
How QWED handles public security issues
The public disclosure and remediation lifecycle
Report → Validate → Fix → Release → Disclose → Verify
The sequence is designed to make remediation actionable for users while retaining a public evidence trail of the affected version, fix, and source records.
Responsible vulnerability disclosure
Coordinated intake and resolution
QWED welcomes responsible vulnerability reports. Please report potential vulnerabilities privately through the GitHub Security Advisory private reporting flow or contact maintainers directly rather than filing a public issue for an unpatched vulnerability. We will assess the report, coordinate remediation where appropriate, and acknowledge contributors in public disclosures when they consent to credit.
Repository security documentation
Source repositories and security policies
- QWED Verification (Core)qwed on PyPI · Python symbolic verification libraryGitHub Security
- QWED MCPqwed-mcp on PyPI · Model Context Protocol serverGitHub Security
Deployment and verification controls
Architecture principles for production AI safety
Deployment flexibility
Use QWED where your risk model requires it, including managed environments, self-hosted deployments, and tighter internal boundaries.
Data handling controls
Verification workloads often need clear controls around retention, transport, storage, and operational access. QWED is designed with those requirements in mind.
Auditability
The point of a verification layer is not only to block errors, but also to make it clear what was checked, what failed, and why a result was allowed through.
Frequently asked questions
Common security and data handling questions