Qiskit Machine Learning supports one minor version release at a time, both for bug and security fixes.

As an additional resource, you can find more details on the release and support schedule of Qiskit in the documentation.

You can privately report a potential vulnerability or security issue via the GitHub security vulnerabilities feature, which can be accessed here:

https://github.com/qiskit-community/qiskit-machine-learning/security/advisories

1. Include Details: In your report, please include as much information as possible to help us understand the nature and scope of the vulnerability. This might include:

   • The link to the filed issue stub.
   • A description of the vulnerability and its impact.
   • Steps to reproduce the issue or a proof-of-concept (PoC) for independent confirmation.
   • Any potential fixes or recommendations you might have.

2. Response Time: We will acknowledge your report within 3 business days and provide you with an estimated time frame for resolving the issue.

Models can be manipulated to produce undesired outputs and can be susceptible to backdoor triggers to expose confidential information¹. Be careful about using untrusted models and sharing models.

You can find more details on the security vulnerability feature in the GitHub documentation here:

https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability

Thank you for helping keep our project secure!