| 1 |
# Security Policy |
| 2 |
|
| 3 |
Full details of the Automattic Security Policy can be found on [](https://automattic.com/security/automattic.com](https://automattic.com/security/](https://automattic.com/security/). |
| 4 |
|
| 5 |
## Supported Versions |
| 6 |
|
| 7 |
Generally, only the latest version of Jetpack has continued support. If a critical vulnerability is found in the current version of Jetpack, we may opt to backport any patches to previous versions. |
| 8 |
|
| 9 |
## Reporting a Vulnerability |
| 10 |
|
| 11 |
[](https://jetpack.com/Jetpack](https://jetpack.com/](https://jetpack.com/) is an open-source plugin for WordPress. Our HackerOne program covers the plugin software, as well as a variety of related projects and infrastructure. |
| 12 |
|
| 13 |
**For responsible disclosure of security issues and to be eligible for our bug bounty program, please submit your report via the [](https://hackerone.com/automatticHackerOne](https://hackerone.com/automattic](https://hackerone.com/automattic) portal.** |
| 14 |
|
| 15 |
Our most critical targets are: |
| 16 |
|
| 17 |
* Jetpack and the Jetpack composer packages (all within this repo) |
| 18 |
* Jetpack.com -- the primary marketing site. |
| 19 |
* cloud.jetpack.com -- a management site. |
| 20 |
* wordpress.com -- the shared management site for both Jetpack and WordPress.com sites. |
| 21 |
|
| 22 |
For more targets, see the `In Scope` section on [](https://hackerone.com/automatticHackerOne](https://hackerone.com/automattic](https://hackerone.com/automattic). |
| 23 |
|
| 24 |
_Please note that the **WordPress software is a separate entity** from Automattic. Please report vulnerabilities for WordPress through [](https://hackerone.com/wordpressthe WordPress Foundation's HackerOne page](https://hackerone.com/wordpress](https://hackerone.com/wordpress)._ |
| 25 |
|
| 26 |
## Guidelines |
| 27 |
|
| 28 |
We're committed to working with security researchers to resolve the vulnerabilities they discover. You can help us by following these guidelines: |
| 29 |
|
| 30 |
* Follow [](https://www.hackerone.com/disclosure-guidelinesHackerOne's disclosure guidelines](https://www.hackerone.com/disclosure-guidelines](https://www.hackerone.com/disclosure-guidelines). |
| 31 |
* Pen-testing Production: |
| 32 |
* Please **setup a local environment** instead whenever possible. Most of our code is open source (see above). |
| 33 |
* If that's not possible, **limit any data access/modification** to the bare minimum necessary to reproduce a PoC. |
| 34 |
* **_Don't_ automate form submissions!** That's very annoying for us, because it adds extra work for the volunteers who manage those systems, and reduces the signal/noise ratio in our communication channels. |
| 35 |
* To be eligible for a bounty, all of these guidelines must be followed. |
| 36 |
* Be Patient - Give us a reasonable time to correct the issue before you disclose the vulnerability. |
| 37 |
|
| 38 |
We also expect you to comply with all applicable laws. You're responsible to pay any taxes associated with your bounties. |
| 39 |
|
