Is NEXUS-Q ready for production?
The project does not claim production readiness. It is an engineering project with strong CI gates, but there has been no independent audit or certification. Evaluate it, review it, and treat it accordingly.
Has it been audited?
No independent external audit has been completed, and none is implied by a GitHub release. The project states it will link a public evidence package from the repository if one exists.
Why is it slower than AWS-LC and others?
V1 was built to be correct and secure first. Its Arena run measured it roughly 2 to 4.5 times slower than the fastest implementations. V3 keeps zeroization and hardening and accepts the cost. V4 plans optimized AVX2 and NEON kernels, enabled by default only after a strict validation checklist.
Why combine ML-KEM with X25519?
A hybrid keeps the key exchange protected as long as at least one of the two schemes holds up. That is the usual reasoning for hybrids while post-quantum algorithms are still young in deployment.
Can I use it from Python, Go, C, PHP or Ruby?
The repository includes a C SDK, a Python binding and Go, PHP and Ruby bindings, covered by a dedicated SDK CI. They are not published to package registries, so you build them from source. See the SDK guide.
What license is it under?
You can choose either the MIT license or the Apache License 2.0, the same dual license used by much of the Rust ecosystem.
How can I help?
Read the threat model, run the Arena yourself, review the code, and open an issue or a pull request. Performance work for V4 is tracked in Issue #23. Security reports go through GitHub Security Advisories.