[0zymandiass]

I believe QPR includes security fixes as well, which should trigger the 4 month timer

Your comment seemed to imply that a source release would trigger a different timer than a binary release, which is explicitly covered as the same thing in the law - for both the 4 and 6 month timers.