You can find our full security documentation in our handbook.
We currently provide security updates for the latest versions.
You can find more information about this here.
If you discover a security vulnerability, please report it privately through one of the channels below:
- Our Bug Bounty VDP program on HackerOne, which you can access here.
- A private security advisory on GitHub, which you can open here.
Please do not report vulnerabilities through public GitHub issues, pull requests, discussions, or any other public channel. Submit each report through only one of the listed channels to avoid duplicate submissions.
Reports should include:
- Description
- Affected version
- Steps to reproduce
- Identified impact
- Proof of Concept (PoC): preferably a video, as it speeds up validation.
Note: At this time, we do not offer monetary rewards for reported vulnerabilities.
No information regarding a reported vulnerability may be publicly disclosed, in whole or in part, until a fix has been released and Rocket.Chat has formally disclosed the vulnerability.
We are committed to:
- Responsibly validating and fixing vulnerabilities.
- Notifying users when a security update is released.
- Formally acknowledging researchers who help improve Rocket.Chat's security.
Thank you for helping us keep this project safe for everyone!