hoppscotch/SECURITY.md

Security Policy

This document outlines security procedures and general policies for the Hoppscotch project.

• Security Policy
  • Reporting a security vulnerability
  • Incident response process

Reporting a security vulnerability

Report security vulnerabilities by emailing the Hoppscotch Support team at support@hoppscotch.io.

The primary security point of contact from Hoppscotch Support team will acknowledge your email within 48 hours, and will send a more detailed response within 48 hours indicating the next steps in handling your report. After the initial reply to your report, the security team will endeavor to keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.

Do not create a GitHub issue ticket to report a security vulnerability.

The Hoppscotch team and community take all security vulnerability reports in Hoppscotch seriously. Thank you for improving the security of Hoppscotch. We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions.

Report security bugs in third-party modules to the person or team maintaining the module.

Incident response process

In case an incident is discovered or reported, we will follow the following process to contain, respond, and remediate:

1. Confirm the problem and determine the affected versions.
2. Audit code to find any potential similar problems.
3. Prepare fixes for all releases still under maintenance. These fixes will be deployed as fast as possible to production.