QEMU Security Process: Disclosure and Embargo Policy

The QEMU security process requires reporting security issues through GitLab issues marked as confidential, and notes that disclosure will eventually become public. The policy page states that as AI/LLM agents are widely used for security auditing, vulnerabilities found by automated tools are likely to be independently rediscovered quickly, so maintainers generally refuse arbitrary embargo requests, with exceptions considered on a case-by-case basis. If a patch cannot be provided within a reasonable time, maintainers may disclose the issue without a patch. The page does not indicate the date of policy revision.