Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
102 lines (72 loc) · 3.25 KB

CONTRIBUTING.md

File metadata and controls

102 lines (72 loc) · 3.25 KB
Raw

Contributing to Qute

Thank you for your interest in contributing. Qute (Quantum Unified Threat Engine) is a local-first quantum-classical hybrid threat detection system built on CUDA-Q, DuckDB, and Streamlit. Contributions that improve detection accuracy, extend the feature vector, add new attack simulations, or improve the user experience are welcome.

Before you start

Please open an issue before writing code. This avoids wasted effort if a feature is already in progress, outside scope, or planned differently. For bug fixes, an issue also helps confirm the bug is reproducible and understood before a fix is attempted.

Development setup

Requirements:

  • Python 3.11
  • CUDA-Q 0.14.0 (or compatible)
  • Docker + Docker Compose (for GPU build)
  • NVIDIA GPU recommended for VQC benchmarking

Quick start:

git clone https://github.com/marjatmm-sec/qute
cd qute
git checkout dev

# CPU-only (no GPU required)
pip install -r requirements.txt
streamlit run src/ui/app.py

# GPU build (recommended)
docker compose up --build

Running the optimiser:

python3 scripts/optimise_vqc_params.py --trials 8 --maxiter 2000

Recomputing feature vectors after changes:

python3 scripts/recompute_feature_vectors.py

Branch conventions

main    ← stable, protected, tagged releases only
dev     ← integration branch, default for PRs
  • All work targets dev — never commit directly to main
  • main is updated only via PR from dev at stable milestones
  • Branch protection rules are configured but not enforced on the private repo — please self-enforce the convention

What we will and won't merge

Will merge:

  • Bug fixes with a clear reproduction case
  • New Sigma detection rules (40 rules currently across Linux/Windows/Network)
  • Feature vector extensions with justification and benchmark evidence
  • New attack simulation factories in replay.py
  • UI improvements that don't break existing tabs
  • Documentation improvements
  • Performance improvements to the VQC pipeline

Won't merge:

  • Features that require cloud APIs or send data off the local machine
  • Changes that break the local/privacy-preserving nature of the project
  • VQC parameter changes without benchmark evidence showing improvement
  • Breaking changes to the DB schema without a migration in migrations.py
  • Features without a clear security detection use case

The maintainer reserves the right to decline PRs that don't fit the project direction, even if technically correct.

PR checklist

  • Targets dev branch, not main
  • No credentials, API keys, or personal data committed
  • All modified Python files pass syntax check (python3 -m py_compile)
  • Feature vector changes accompanied by benchmark results
  • Schema changes include a migration in src/store/migrations.py
  • README updated if behaviour or project structure changed
  • PR description explains what changed and why

Reporting security vulnerabilities

Please do not open a public issue for security vulnerabilities in Qute itself. See SECURITY.md for the responsible disclosure process.

Licence

By contributing to Qute, you agree that your contributions will be licensed under the MIT License.