generated: '2026-08-13'
method: searched
source: https://docs.ghost.org/security
provider: Ghost
providerId: ghost-org
description: >-
  Ghost publishes a responsible-disclosure programme on its developer documentation with
  a named security contact, stated researcher obligations, an explicit in-scope /
  out-of-scope triage list, and time-bound response commitments. There is no bug bounty
  and no security.txt; credit is given as a public acknowledgement on the security commit.
program:
  published: true
  type: responsible-disclosure
  bounty: false
  policy_url: https://docs.ghost.org/security
  contact: security@ghost.org
  contact_type: email
  security_txt: false
  security_txt_note: >-
    Probed /.well-known/security.txt on ghost.org, docs.ghost.org and demo.ghost.io on
    2026-08-13. All returned 404. See well-known/ghost-org-well-known.yml.
  repository_policy: https://github.com/TryGhost/Ghost/blob/main/SECURITY.md
  handling: >-
    The Ghost Security Team works privately in a secured, isolated repository for
    tracking, testing and resolving reported issues. Security fixes take precedence over
    bug fixes and feature work, and releases containing serious fixes are marked urgent.
commitments:
- action: acknowledge report
  within: 1 week
- action: investigate and share findings
  within: 2 weeks
- action: resolve critical issues
  within: 1 month
- action: resolve low-priority issues
  within: 3 months
- action: credit reporter on the resulting open source commit
  within: on release
researcher_expectations:
- Provide reproduction detail and a proof of concept.
- Make a good faith effort to avoid privacy violations and destruction or modification of data on live sites.
- Give reasonable time to correct the issue before publishing.
in_scope:
- Remote Code Execution (RCE)
- SQL Injection (SQLi)
- Server Side Request Forgery (SSRF)
- Cross Site Request Forgery (CSRF)
- Cross Site Scripting (XSS) by an untrusted user
out_of_scope:
- Privilege escalation by trusted users publishing arbitrary JavaScript
- HTTP sniffing or HTTP tampering exploits
- Open API endpoints serving public data
- Ghost version number disclosure
- Brute force, DoS, DDoS, phishing, text injection and social engineering
- Output from automated scans
- Clickjacking with minimal security implications
- Missing DMARC records
platform_controls:
- control: device verification
  detail: Staff logins from a new or unrecognised device require an emailed code.
- control: email 2FA
  detail: Ghost can be configured to require an emailed two-factor code on all staff logins.
- control: brute force protection
  detail: Login attempts and password resets limited to 5 per hour per IP address.
- control: automatic SSL
  detail: Ghost-CLI provisions Let's Encrypt certificates on new installs by default.
- control: password hashing
  detail: bcrypt with salting, following OWASP authentication guidance.
- control: single-use expiring tokens
  detail: Invitation and password reset tokens are base64 encoded with a server-side secret, single use, always expiring.
- control: SQLi prevention
  detail: Bookshelf ORM plus Knex query builder; no hand-written raw SQL and no variable interpolation into SQL strings.
- control: dependency scanning
  detail: Continuous scanning via GitHub tooling plus yarn audit.
x-evidence:
  fetched: '2026-08-13'
  url: https://docs.ghost.org/security
  http_status: 200
notes: >-
  External review is invited on the open source codebase at
  https://github.com/tryghost/ghost. Ghost states it commissions consultation and
  penetration testing with external security researchers and agencies, but publishes no
  report, certification or trust centre — see conformance/ghost-org-conformance.yml.