qubes-doc/project-security/security.md

---
lang: en
layout: doc
permalink: /security/
redirect_from:
- /en/security/
- /en/doc/security/
- /en/doc/qubes-security/
- /doc/QubesSecurity/
- /wiki/QubesSecurity/
- /en/doc/security-page/
- /doc/SecurityPage/
- /wiki/SecurityPage/
- /trac/wiki/SecurityPage/
ref: 217
title: Qubes OS Project Security Center
---

This page provides a central hub for topics pertaining to the security of the Qubes OS Project.
For topics pertaining to software security *within* Qubes OS, see [Security in Qubes](/doc/#security-in-qubes).
The following is a list of important project security pages:

- [Qubes Security Pack (`qubes-secpack`)](/security/pack/)
- [Qubes Security Bulletins (QSBs)](/security/bulletins/)
- [Qubes Canaries](/security/canaries/)
- [Xen Security Advisory (XSA) Tracker](/security/xsa/)
- [Verifying signatures](/security/verifying-signatures/)
- [PGP keys](https://keys.qubes-os.org/keys/)
- [Security FAQ](/faq/#general--security)

## Reporting Security Issues in Qubes OS

If you believe you have found a security issue affecting Qubes OS, either directly or indirectly (e.g. the issue affects Xen in a configuration that is used in Qubes OS), then we would be more than happy to hear from you!
We promise to treat any reported issue seriously and, if the investigation confirms that it affects Qubes, to patch it within a reasonable time and release a public [Qubes Security Bulletin](/security/bulletins/) that describes the issue, discusses the potential impact of the vulnerability, references applicable patches or workarounds, and credits the discoverer.

## Security Updates

Qubes security updates are obtained by [Updating Qubes OS](/doc/updating-qubes-os/).

## The Qubes Security Team

The Qubes Security Team (QST) is the subset of the [Qubes Team](/team/) that is responsible for ensuring the security of Qubes OS and the Qubes OS Project.
In particular, the QST is responsible for:

- Responding to [reported security issues](#reporting-security-issues-in-qubes-os)
- Evaluating whether [XSAs](/security/xsa/) affect the security of Qubes OS
- Writing, applying, and/or distributing security patches to fix vulnerabilities in Qubes OS
- Writing, signing, and publishing [Security Bulletins](/security/bulletins/)
- Writing, signing, and publishing [Canaries](/security/canaries/)
- Generating, safeguarding, and using the project's [PGP Keys](https://keys.qubes-os.org/keys/)

As a security-oriented operating system, the QST is fundamentally important to Qubes, and every Qubes user implicitly trusts the members of the QST by virtue of the actions listed above.
The Qubes Security Team can be contacted via email at the following address:

```
security at qubes-os dot org
```

### Security Team PGP Key

Please use the [Security Team PGP Key](https://keys.qubes-os.org/keys/qubes-os-security-team-key.asc) to encrypt all emails sent to this address.
This key is signed by the [Qubes Master Signing Key](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc).
Please see [Why and How to Verify Signatures](/security/verifying-signatures/) for information about how to verify these keys.

### Members of the Security Team

- [Marek Marczykowski-Górecki](/team/#marek-marczykowski-górecki)
- [Simon Gaiser (aka HW42)](/team/#simon-gaiser-aka-hw42)
- [Joanna Rutkowska](/team/#joanna-rutkowska) ([emeritus, canaries only](/news/2018/11/05/qubes-security-team-update/))
Reorganize security info pages 2017-03-18 22:31:12 -04:00			`---`
Add lang + ref tags to frontmatter Those are fields used by the language switcher to correlate pages across different languages, even if they have different names/paths/titles. They are generated with the prepare_for_translation.py script. 2021-03-13 13:06:18 -05:00			`lang: en`
Use default doc layout for project security docs 2019-05-26 21:04:23 -04:00			`layout: doc`
Revert "Remove all instances of `permalink:` in YAML frontmatter" This reverts commit c815e4c54c315dfca30c66f6a33e07b1ff90b786. https://github.com/QubesOS/qubes-issues/issues/6701#issuecomment-862822827 2021-06-16 22:56:25 -04:00			`permalink: /security/`
Markdown formatting fixes - mark all code blocks with ``` - unify empty lines between sections - adjust list syntax (no space before dash) - adjust headers to use Atx-style syntax - remove trailing spaces 2021-03-13 12:03:23 -05:00			`redirect_from:`
Reorganize security info pages 2017-03-18 22:31:12 -04:00			`- /en/security/`
			`- /en/doc/security/`
			`- /en/doc/qubes-security/`
			`- /doc/QubesSecurity/`
			`- /wiki/QubesSecurity/`
			`- /en/doc/security-page/`
			`- /doc/SecurityPage/`
			`- /wiki/SecurityPage/`
			`- /trac/wiki/SecurityPage/`
Add lang + ref tags to frontmatter Those are fields used by the language switcher to correlate pages across different languages, even if they have different names/paths/titles. They are generated with the prepare_for_translation.py script. 2021-03-13 13:06:18 -05:00			`ref: 217`
Update and reorganize documentation - Convert "Common Tasks" to "How-to Guides" (QubesOS/qubes-issues#6694) - Make title capitalization consistent across docs - Fix leftover h1 headings - Reorganize various pages and topics - Update permalinks to better match titles - Create redirects for changed permalinks - Miscellaneous cleanup QubesOS/qubes-issues#6701 2021-06-17 07:23:57 -04:00			`title: Qubes OS Project Security Center`
Reorganize security info pages 2017-03-18 22:31:12 -04:00			`---`

Update Security Center intro section The "Security Goals" page is actually more of a statement of the developers' security design goals. It does not realy pertain to project security, which is what the "Security Center" page is about, so I'm moving it to the developer docs (index updated in a separate commit). 2021-06-15 01:07:36 -04:00			`This page provides a central hub for topics pertaining to the security of the Qubes OS Project.`
			`For topics pertaining to software security within Qubes OS, see [Security in Qubes](/doc/#security-in-qubes).`
			`The following is a list of important project security pages:`

			- [Qubes Security Pack (`qubes-secpack`)](/security/pack/)
			`- [Qubes Security Bulletins (QSBs)](/security/bulletins/)`
			`- [Qubes Canaries](/security/canaries/)`
Refactor links in order to obey the new convention rule 2021-04-10 18:09:05 -04:00			`- [Xen Security Advisory (XSA) Tracker](/security/xsa/)`
Update Security Center intro section The "Security Goals" page is actually more of a statement of the developers' security design goals. It does not realy pertain to project security, which is what the "Security Center" page is about, so I'm moving it to the developer docs (index updated in a separate commit). 2021-06-15 01:07:36 -04:00			`- [Verifying signatures](/security/verifying-signatures/)`
			`- [PGP keys](https://keys.qubes-os.org/keys/)`
			`- [Security FAQ](/faq/#general--security)`
Clarify language, improve links, and clean up source 2018-01-31 23:40:01 -05:00
Markdown formatting fixes - mark all code blocks with ``` - unify empty lines between sections - adjust list syntax (no space before dash) - adjust headers to use Atx-style syntax - remove trailing spaces 2021-03-13 12:03:23 -05:00			`## Reporting Security Issues in Qubes OS`
Reorganize security info pages 2017-03-18 22:31:12 -04:00
Update security.md 2017-04-17 20:18:46 -04:00			`If you believe you have found a security issue affecting Qubes OS, either directly or indirectly (e.g. the issue affects Xen in a configuration that is used in Qubes OS), then we would be more than happy to hear from you!`
Refactor links in order to obey the new convention rule 2021-04-10 18:09:05 -04:00			`We promise to treat any reported issue seriously and, if the investigation confirms that it affects Qubes, to patch it within a reasonable time and release a public [Qubes Security Bulletin](/security/bulletins/) that describes the issue, discusses the potential impact of the vulnerability, references applicable patches or workarounds, and credits the discoverer.`
Reorganize security info pages 2017-03-18 22:31:12 -04:00
Markdown formatting fixes - mark all code blocks with ``` - unify empty lines between sections - adjust list syntax (no space before dash) - adjust headers to use Atx-style syntax - remove trailing spaces 2021-03-13 12:03:23 -05:00			`## Security Updates`
Add section on security updates 2019-08-26 20:39:40 -04:00
Refactor links in order to obey the new convention rule 2021-04-10 18:09:05 -04:00			`Qubes security updates are obtained by [Updating Qubes OS](/doc/updating-qubes-os/).`
Reorganize security info pages 2017-03-18 22:31:12 -04:00
Markdown formatting fixes - mark all code blocks with ``` - unify empty lines between sections - adjust list syntax (no space before dash) - adjust headers to use Atx-style syntax - remove trailing spaces 2021-03-13 12:03:23 -05:00			`## The Qubes Security Team`
Reorganize security info pages 2017-03-18 22:31:12 -04:00
Refactor links in order to obey the new convention rule 2021-04-10 18:09:05 -04:00			`The Qubes Security Team (QST) is the subset of the [Qubes Team](/team/) that is responsible for ensuring the security of Qubes OS and the Qubes OS Project.`
Update Security page - Add Qubes Security Team (QST) description - Add Simon as QST member - Add "(emeritus, canaries only)" with link next to Joanna's name; move to bottom 2018-11-05 21:21:43 -05:00			`In particular, the QST is responsible for:`

Refactor links in order to obey the new convention rule 2021-04-10 18:09:05 -04:00			`- Responding to [reported security issues](#reporting-security-issues-in-qubes-os)`
			`- Evaluating whether [XSAs](/security/xsa/) affect the security of Qubes OS`
Markdown formatting fixes - mark all code blocks with ``` - unify empty lines between sections - adjust list syntax (no space before dash) - adjust headers to use Atx-style syntax - remove trailing spaces 2021-03-13 12:03:23 -05:00			`- Writing, applying, and/or distributing security patches to fix vulnerabilities in Qubes OS`
Refactor links in order to obey the new convention rule 2021-04-10 18:09:05 -04:00			`- Writing, signing, and publishing [Security Bulletins](/security/bulletins/)`
			`- Writing, signing, and publishing [Canaries](/security/canaries/)`
			`- Generating, safeguarding, and using the project's [PGP Keys](https://keys.qubes-os.org/keys/)`
Update Security page - Add Qubes Security Team (QST) description - Add Simon as QST member - Add "(emeritus, canaries only)" with link next to Joanna's name; move to bottom 2018-11-05 21:21:43 -05:00
			`As a security-oriented operating system, the QST is fundamentally important to Qubes, and every Qubes user implicitly trusts the members of the QST by virtue of the actions listed above.`
Clarify language, improve links, and clean up source 2018-01-31 23:40:01 -05:00			`The Qubes Security Team can be contacted via email at the following address:`

Markdown formatting fixes - mark all code blocks with ``` - unify empty lines between sections - adjust list syntax (no space before dash) - adjust headers to use Atx-style syntax - remove trailing spaces 2021-03-13 12:03:23 -05:00			```
			`security at qubes-os dot org`
			```
Reorganize security info pages 2017-03-18 22:31:12 -04:00
Markdown formatting fixes - mark all code blocks with ``` - unify empty lines between sections - adjust list syntax (no space before dash) - adjust headers to use Atx-style syntax - remove trailing spaces 2021-03-13 12:03:23 -05:00			`### Security Team PGP Key`
Reorganize security info pages 2017-03-18 22:31:12 -04:00
Refactor links in order to obey the new convention rule 2021-04-10 18:09:05 -04:00			`Please use the [Security Team PGP Key](https://keys.qubes-os.org/keys/qubes-os-security-team-key.asc) to encrypt all emails sent to this address.`
			`This key is signed by the [Qubes Master Signing Key](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc).`
			`Please see [Why and How to Verify Signatures](/security/verifying-signatures/) for information about how to verify these keys.`
Reorganize security info pages 2017-03-18 22:31:12 -04:00
Markdown formatting fixes - mark all code blocks with ``` - unify empty lines between sections - adjust list syntax (no space before dash) - adjust headers to use Atx-style syntax - remove trailing spaces 2021-03-13 12:03:23 -05:00			`### Members of the Security Team`
Reorganize security info pages 2017-03-18 22:31:12 -04:00
Refactor links in order to obey the new convention rule 2021-04-10 18:09:05 -04:00			`- [Marek Marczykowski-Górecki](/team/#marek-marczykowski-górecki)`
			`- [Simon Gaiser (aka HW42)](/team/#simon-gaiser-aka-hw42)`
			`- [Joanna Rutkowska](/team/#joanna-rutkowska) ([emeritus, canaries only](/news/2018/11/05/qubes-security-team-update/))`