Qubes OS Security in the Public Record

A longitudinal analysis examines 109 public Qubes Security Bulletins from 2011 to 2025, alongside the official Xen Security Advisory tracker. The study focuses on the public advisory record rather than latent vulnerabilities or actual compromises. Utilizing a protocol-driven methodology, the research employs deterministic component attribution, change-point analysis, and severity-proxy weighting. This evaluation measures security-relevant component boundaries within the Qubes OS architecture to assess the documented history of vulnerability events and documentary latency lower bounds.