Chatwoot is looking forward to working with security researchers worldwide to keep Chatwoot and our users safe. If you have found an issue in our systems/applications, please reach out to us.
We use GitHub for security issues that affect our project. If you believe you have found a vulnerability, please disclose it via this form.This will enable us to review the vulnerability, fix it promptly, and reward you for your efforts.If you have any questions about the process, contact security@chatwoot.com.Please try your best to describe a clear and realistic impact for your report, and please don’t open any public issues on GitHub or social media; we’re doing our best to respond through GitHub as quickly as possible.
Please use the email for questions related to the process. Disclosures should be done via GitHub.
Chatwoot team triages the issues in GitHub weekly. We’re doing our best to respond through GitHub as quickly as we can, so please don’t open any public issues on GitHub or social media and avoid duplicate reports over emails.
Based on reviewing the report, the team will assign a priority to the issue and move it into the internal backlog to prioritize a fix.
In cases where the team needs more information or disagreements of severity, the team will communicate the same over GitHub before completing the triaging.
After triage, the team will start working on the issue based on the following severity and timelines:
While we don’t currently have a formal bug bounty program, we do recognize and appreciate security researchers who help us improve Chatwoot’s security:
Hall of Fame: Recognition on our security acknowledgments page
Direct Communication: Work directly with our security team
Early Access: Get early access to security updates and patches
Thank you for keeping Chatwoot and our users safe. 🙇Your efforts help us maintain a secure platform for thousands of businesses worldwide. We appreciate the time and expertise you contribute to making Chatwoot better for everyone.Remember: Security is a shared responsibility. Together, we can make Chatwoot safer for everyone.