Responsible Disclosure Policy A M
Responsible Disclosure Policy
Safety and data security is of utmost priority for the Mattermost community. If you are a security researcher and have discovered a security vulnerability in our code base, we appreciate your help in disclosing it to us in a responsible manner.
Please refrain from requesting compensation for reporting vulnerabilities.
We will acknowledge receipt of your vulnerability report and send you regular updates about our progress.
If your report is reproducible as an exploit and results in a change to the code base or documentation of a Mattermost product, we will–at your option–publicly acknowledge your responsible disclosure.
After a fix is made, we ask security researchers to wait 14 days after a release before announcing the specific details of a vulnerability, and to provide Mattermost with a link to any such announcements. In releases containing security fixes, Mattermost announces an update is available, acknowledges the contributions of security researches, and it withholds specific details until 14 days after availability to give time for the community to apply updates.
You are not allowed to search for vulnerabilities on any instance of Mattermost hosted by the team, users, or customers with the exception of non-disruptive testing on the community test server mentioned above.
Mattermost is open source software, you can install a copy yourself and test against that. If you want to perform testing that might break things please contact us to arrange access to a private staging server, so you don’t disrupt other people’s work on the community test server.
Many thanks to the security researchers who have responsibly contributed their findings to make the Mattermost code base more secure (listed by number of contributions, then alphabetically).
Security Research Hall of Fame:
Andreas Lindh (11 contributions)
Frans Rosén (11 contributions)
Christopher Brown (9 contributions)
Yoni Ramon from Tesla security team (7 contributions)
Joram Wilander (5 contributions)
Martijn Korse, Jelle Kroon, Ömer Coskun, and Bernardo Maia Rodrigues of the KPN Red Team (4 contributions)
Harrison Healey (4 contributions)
Uchida Taishi (3 contributions)
Bastian Ike (2 contributions)
Đỗ Minh Tuấn & Thanh Nguyen Van Tien (2 contributions)