You can find our full security documentation in our [handbook](https://handbook.rocket.chat/space/SEC/6226148/SECURITY).

---

## Supported Versions

We currently provide security updates for the latest versions.  
You can find more information about this [here](https://docs.rocket.chat/docs/version-durability).

---

## Reporting Vulnerabilities

If you discover a security vulnerability, please report it privately through one of the channels below:

- Our **Bug Bounty VDP program** on **HackerOne**, which you can access [here](https://hackerone.com/rocket_chat).
- A **private security advisory** on GitHub, which you can open [here](https://github.com/RocketChat/Rocket.Chat/security/advisories/new).
 

Please do not report vulnerabilities through public GitHub issues, pull requests, discussions, or any other public channel. Submit each report through only one of the listed channels to avoid duplicate submissions.

Reports should include:

- Description
- Affected version
- Steps to reproduce
- Identified impact
- Proof of Concept (PoC): preferably a video, as it speeds up validation.

> **Note:** At this time, we do not offer monetary rewards for reported vulnerabilities.

### Confidentiality

No information regarding a reported vulnerability may be publicly disclosed, in whole or in part, until a fix has been released and Rocket.Chat has formally disclosed the vulnerability.

---

## Disclosure

We are committed to:

- Responsibly validating and fixing vulnerabilities.
- Notifying users when a security update is released.
- Formally acknowledging researchers who help improve Rocket.Chat's security.

---

## Thank You

Thank you for helping us keep this project safe for everyone!