COSMOS-CQAPublic Research Portal

Public trust

Security and responsible disclosure.

Use this page to route COSMOS-CQA vulnerability, safety, accessibility, and data-handling reports without exposing sensitive details in public project surfaces.

Email Private Report Repository Security Policy

Choose the right reporting lane

Private vulnerabilitiesDo not file public issues for vulnerabilities, reproducible exploit steps, credentials, deployment secrets, restricted data exposure, or private infrastructure concerns.
Public safety reportsUse the safety template only for non-sensitive audio, visual, data-handling, public-copy, or claim-boundary concerns.
Public accessibility reportsUse the accessibility template for barriers that can be reproduced without personal health information, regulated data, or private screenshots.
General questionsUse the contact route for public research questions, documentation corrections, release artifact questions, and non-confidential routing help.

What not to share publicly

Do not include credentials, private keys, session cookies, personal health information, regulated data, restricted datasets, private source code, private screenshots, deployment secrets, or medical/audiology advice in public GitHub issues, pull requests, comments, or email examples.

For private vulnerability email, use the subject prefix COSMOS-CQA vulnerability report and start with a minimal non-confidential summary.

Disclosure boundary: public reports should describe the surface and impact without exposing sensitive reproduction details. Private reports should begin with a minimal non-confidential summary and indicate whether details are available on request.

Maintained scope

  • The static public portal at cosmos-cqa.org.
  • The browser research workbench, shared packages, schemas, examples, and release artifacts.
  • Public safety boundaries for optional audio sonification, visual review surfaces, local-first data handling, and claim limits.
  • Repository workflows, documentation, issue templates, and deployment validation checks.

COSMOS-CQA is not a production service, clinical tool, diagnostic system, regulated workflow, or validated scientific decision system.

Public routes