NEXUS-Q v4.1.2: Stable Release and Independent Audit Invitation
NEXUS-Q v4.1.2 is the project's current stable release. We are inviting security researchers, experienced developers, and prospective auditors to examine the code and documentation as the project prepares for an independent security audit.
What is NEXUS-Q?
NEXUS-Q is an open-source cryptographic engine written in Rust for protecting data, keys, and identities. Its documented scope includes post-quantum cryptography such as ML-KEM and ML-DSA, vault and key-management functionality, identity and PKI components, SDKs, and a tamper-evident audit log.
What is available in v4.1.2?
The v4.1.2 release is published on GitHub with its release notes and artifacts. The project documents its tested configurations and security boundaries, including the fact that the native ML-KEM/ML-DSA backend remains experimental and opt-in; normal production call paths default to RustCrypto.
The auxiliary Rust service crates nexusq-admin, nexusq-pki-cluster, nexusq-hsm, nexusq-enrollment, nexusq-ha, nexusq-ocsp, nexusq-tsa, and nexusq-x509 remain available at their published v4.1.1 versions. The v4.1.2 documentation closeout did not republish these crates.
What we are asking from the community
- Review the implementation and documented security assumptions.
- Check the release artifacts and build/reproducibility information.
- Report reproducible bugs or security concerns through the repository's appropriate reporting channels.
- Get in touch if you are qualified to conduct or sponsor an independent security audit.
Explore the project
Our goal is to make the project easier to inspect and improve through transparent, independent technical feedback. If you review NEXUS-Q, please distinguish verified findings from assumptions and help us make the project's security posture clearer.