KAS · version 0.1.2 · draft, not in force

KAS security and disclosure

DRAFT. Counsel has not reviewed this page. It is not in force. Times and roles marked proposed are not a promise.

AI Verify process checks 5.8.1, 5.13.1. This page is the public text for those checks. It is not a pass mark. Certification is in progress. Qypu holds no certificate yet.

In one line

How to report a KAS vulnerability to security@qypu.ai. Draft: 2 working days to acknowledge, and 7 days to triage.

The short version

This short version helps you understand the full text. Read the full text for the complete terms.

  • Email security@qypu.ai. Do not open a public issue for a vulnerability. (Full text, How to report)
  • Draft: acknowledge in 2 working days, and triage in 7 days. These times are not in force. (Draft times)
  • Test your own copy. Do not attack a system you do not own. (Rules)
  • An independent audit is in progress. Qypu holds no certificate yet. (Scope and status)
  • A PGP key is planned. None is published. (How to report)
  • No remediation plan is operating. The steps below are a draft. (If something is already wrong)

Full text

Which checks this page answers

This page is the public text for AI Verify process checks 5.8.1 and 5.13.1. It adapts the draft in SECURITY.md. It does not put that draft in force.

How to report

Email security@qypu.ai. That address routes to Byron Fuller. Include the component, the version, the steps to reproduce, and the impact. Include a way to reply.

Do not open a public GitHub issue for a vulnerability. Do not post an exploit where other people can copy it.

A PGP key is planned. None is published. Until one is, do not send live secrets, tokens, or other people's data in the mail. A description is enough.

Machine-readable contact for qypu.ai is /.well-known/security.txt. That file also points at this page.

Draft times

This page and the vulnerability disclosure policy use one set of draft times. Qypu acknowledges a report within 2 working days. Qypu triages it within 7 days. Triage means we say whether we accept the issue, and what we think the impact is.

These times are a draft. They are not a service level. They are not in force.

Rules

Read the safe-harbour and the research rules on the vulnerability disclosure policy. They are a draft. They cover good-faith research. They do not authorise testing of a third party's systems.

For KAS, use your own copy of the code. Do not probe a machine you do not own. Stop if you reach someone else's personal data. Do not keep it.

There is no paid bounty.

Scope and status

In scope: the KAS repository, and kas-gate. Out of scope: third-party platforms, and denial-of-service tests.

This draft adapts SECURITY.md. An independent audit is in progress. Qypu holds no certificate yet. KAS is in build.

SOC 2 Type II: independent audit in progress. Cyber Essentials (UK): certification in progress. Cyber Essentials (Singapore): certification in progress. CyberSecure Canada: certification in progress. Essential Eight (Australia): alignment in progress. The EU AI Act readiness review is in progress. For the IMDA agentic AI framework, KAS is built to follow it, and the review is in progress. Privacy reviews are in progress for the Singapore PDPA, Canada PIPEDA, Quebec Law 25, the Australia Privacy Act, and the NZ Privacy Act.

The Qypu product has a separate security overview. Controls on that page are about qypu.ai. This page is about KAS.

If something is already wrong

Check 5.8.1 asks for incident response, escalation, and remediation. No such plan is operating for KAS.

The draft, if a report shows a real flaw, is this. Record it. Tell the reporter we have it, inside the draft acknowledgement time. Decide the impact, inside the draft triage time. If a deployment exists by then, pause it or revoke the mandate. Fix the code. Agree a disclosure date with the reporter. Tell affected people under the incident page, if any person was affected.

There is no on-call rota, no escalation ladder, and no named incident commander. Mail routes to Byron Fuller. That is the whole chain today.

Change log

  • 2026-10-25 · 0.1.2 · Certification is in progress. No certificate is held yet.
  • 2026-10-23 · 0.1.1 · Draft times match the product disclosure page: 2 working days to acknowledge, and 7 days to triage.
  • 2026-10-23 · 0.1.0 · First public draft, adapted from SECURITY.md. Times marked proposed. Not in force.

Contact

Qypu, Inc., a Delaware C corporation. Contact address: 51A Marang Road, Singapore 099281. Privacy mail privacy@qypu.ai and security mail security@qypu.ai route to Byron Fuller.

KAS · KAS governance · Trust centre · Privacy · Privacy notice