Do not open a public GitHub issue. Report privately via one of:

• AMD Product Security portal: https://www.amd.com/en/resources/product-security.html

Please include: description and impact, steps to reproduce, and affected versions or commits.

We aim to acknowledge reports within 1 business day.

This policy covers code and configuration in this repository. For vulnerabilities in third-party dependencies, report upstream. For AMD product issues unrelated to this repo, use the AMD Product Security portal.

Alongside the reporting path above, this repository is scanned automatically. The scanners are not implemented here: Quartz calls the shared ROCm/rocm-security-gh security-baseline.yml reusable workflow, so the scanner versions and behavior are maintained centrally for ROCm, and this repository supplies only its own configuration (the *.yml / *.toml files at the repo root).

Two workflows run them, and where a finding shows up depends on which one produced it:

• security_scan_pr.yml runs on every pull request, scoped to what that pull request changed. It reports in the job summary and a build artifact, and deliberately does not upload to the Security tab, so pull requests from forks behave the same as those from branches in this repository.
• security_scan_weekly.yml runs on a schedule across the whole repository and uploads SARIF to this repository's Security tab, which is the authoritative view of the current state. Quartz is a monorepo-adjacent, low-churn repository, so a weekly cadence (rather than on every push to develop/main) is enough to keep the Security tab current without adding a scan to every merge.

Contributors can run every scanner locally against the same configuration CI uses; see the security scanners section in CONTRIBUTING.md.