config
3 months ago
core
1 week ago
js
3 months ago
lang
2 weeks ago
libs
1 month ago
node_modules
4 months ago
plugins
1 week ago
vendor
1 week ago
.htaccess
6 years ago
AGENTS.md
2 weeks ago
DIObject.php
2 years ago
LEGALNOTICE
6 months ago
LICENSE
2 years ago
LegacyAutoloader.php
2 years ago
PRIVACY.md
5 years ago
README.md
6 months ago
SECURITY.md
2 years ago
bootstrap.php
1 month ago
console
6 years ago
favicon.ico
2 years ago
index.php
2 years ago
matomo.js
3 months ago
matomo.php
2 years ago
offline-service-worker.js
5 years ago
piwik.js
3 months ago
piwik.php
6 months ago
robots.txt
5 years ago
SECURITY.md
32 lines
| 1 | # Reporting Security Issues |
| 2 | |
| 3 | ## Security Bug Bounty Program |
| 4 | |
| 5 | The Matomo Security Bug Bounty Program is designed to encourage security research in Matomo software and to reward those who help us create the safest web analytics platform. |
| 6 | |
| 7 | Critical security issues will be rewarded up to 13,000 USD. Critical issue in Matomo means an issue in our latest official release at: https://builds.matomo.org/latest.zip as installed on a typical server (and possibly using any of our official plugins by Matomo or InnoCraft from the Marketplace). If you can gain remote code execution on the server (i.e. RCE), or if you're able to delete data with an HTTPS request (i.e. SQL Injection), this may qualify as a Critical issue. |
| 8 | |
| 9 | (Note: If a Remote Code Execution (RCE) is only available when logged in as a Super User, the issue will qualify as "High" and not "Critical".) |
| 10 | |
| 11 | High security issues that can cause a direct attack (CSRF, XSS, Auth bypass, etc.) will be rewarded with up to 1,777 USD. |
| 12 | |
| 13 | Other issues will typically be rewarded by 777 USD (or more or less depending on the impact.) |
| 14 | |
| 15 | |
| 16 | ## Responsible disclosure by email |
| 17 | |
| 18 | |
| 19 | We encourage you to responsibly report issues via our [](https://hackerone.com/matomoMatomo Bug Bounty Program on HackerOne](https://hackerone.com/matomo](https://hackerone.com/matomo) or you can also |
| 20 | [](mailto:security@matomo.org?subject=Reporting%20Vulnerability%20in%20Matomoemail us at security@matomo.org](mailto:security@matomo.org?subject=Reporting%20Vulnerability%20in%20Matomo](mailto:security@matomo.org?subject=Reporting%20Vulnerability%20in%20Matomo). |
| 21 | |
| 22 | If you have found a security issue in Matomo please read [](https://matomo.org/security/our security notes](https://matomo.org/security/](https://matomo.org/security/) regarding responsible disclosures. |
| 23 | |
| 24 | |
| 25 | ## Improve your Matomo Server Security |
| 26 | |
| 27 | [](https://matomo.org/docs/security/Secure Matomo server](https://matomo.org/docs/security/](https://matomo.org/docs/security/): follow these steps to keep your Matomo data safe. |
| 28 | |
| 29 | ## Security announcements |
| 30 | |
| 31 | Please subscribe to [](https://matomo.org/changelog/the Changelog](https://matomo.org/changelog/](https://matomo.org/changelog/) ([](https://matomo.org/changelog/feed/rss feed](https://matomo.org/changelog/feed/](https://matomo.org/changelog/feed/)) to be notified of new releases (including security releases). |
| 32 |