@title Reporting Security Vulnerabilities
@group intro

Describes how to report security vulnerabilities in Phabricator.

Overview
========

Phabricator runs a disclosure and award program through
[[ https://www.hackerone.com/ | HackerOne ]]. This program is the best way to
submit security issues to us, and awards responsible disclosure of
vulnerabilities with cash bounties. You can find our project page
here:

(NOTE) https://hackerone.com/phabricator

The project page has detailed information about the scope of the program and
how to participate.

We have a 24 hour response timeline, and are usually able to respond to (and,
very often, fix) issues more quickly than that.


Other Channels
==============

If you aren't sure if something qualifies or don't want to report via
HackerOne, you can submit the issue as a normal bug report. For instructions,
see @{article:Contributing Bug Reports}.


Get Updated
===========

General information about security changes is reported weekly in the
[[ https://secure.phabricator.com/w/changelog/ | Changelog ]].