---
layout: markdown_page
title: Responsible Disclosure Policy
---

Please email security@gitlab.com to report any security vulnerabilities. Please
refrain from requesting compensation for reporting vulnerabilities. We will
acknowledge receipt of your vulnerability report and send you regular updates
about our progress. If you want we will [publicly acknowledge](https://about.gitlab.com/vulnerability-acknowledgements/)
 your responsible disclosure. You may also send us your report via [HackerOne](https://hackerone.com/gitlab).  


You are not allowed to search for vulnerabilities on GitLab.com itself. GitLab
is open source software, you can install a copy yourself and test against that.
If you want to perform testing that might break things please contact us to
arrange access to a staging server.


If you want to encrypt your disclosure email please email us to ask for our PGP key.

---
layout: markdown_page
title: Responsible Disclosure Policy
---

Please email security@gitlab.com to report any security vulnerabilities. We will
acknowledge receipt of your vulnerability report the next business day and stive to send you regular updates about our progress. If you're curious about the status of your disclosure please feel free to email us again. If you want to encrypt your disclosure email please email us to ask for our PGP key.

Aternatively you may also send us your report via [HackerOne](https://hackerone.com/gitlab).

Please refrain from requesting compensation for reporting vulnerabilities. If you want we will [publicly acknowledge](https://about.gitlab.com/vulnerability-acknowledgements/) your responsible disclosure. We also try to make the confidential issue public after the vulnerability is announced, for an example see our [impersonation feature issue](https://gitlab.com/gitlab-org/gitlab-ce/issues/15548). HackerOne also makes the bug reports [public after 30 days](https://hackerone.com/disclosure-guidelines) if neither party objects, for an example see [the report for a persistent XSS on public project page](https://hackerone.com/reports/129736).

You are not allowed to search for vulnerabilities on GitLab.com itself. GitLab
is open source software, you can install a copy yourself and test against that. You can either download [CE](https://about.gitlab.com/downloads/), [EE](https://about.gitlab.com/downloads-ee/), or the [GitLab Development Kit](https://gitlab.com/gitlab-org/gitlab-development-kit).
If you want to perform testing without setting GitLab up yourself please contact us to
arrange access to a staging server.

On our website you can find more about [the availability and security of GitLab.com](https://about.gitlab.com/gitlab-com/#availability-and-security). Security issues that are not vulnerabilities can be seen on [our public issue tracker](https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B%5D=security).

Make information easier to find.
Make information easier to find.
