woocommerce/docs/security/reporting-security-issues.md

---
post_title: Reporting security issues
---

WooCommerce cares deeply about security and works hard to keep our merchants and their customers safe. 

You can find our security policy [over here](https://github.com/woocommerce/woocommerce/security/policy) and, if you believe you have discovered a vulnerability, we encourage you to follow it and submit your findings via [HackerOne](https://hackerone.com/automattic?type=team)—a trusted third party service that facilitates reporting of security issues. Please refer to the policy for more details, however some key points are as follows:

- We operate a [bug bounty program](https://hackerone.com/automattic?type=team), so you can be rewarded for valid reports, but not everything is in scope. Please check the guidance before posting.
- We strongly encourage [responsible disclosure](https://www.hackerone.com/disclosure-guidelines). To better protect everyone, please use HackerOne and **do not** post your findings in a public forum.

Thank you for being a responsible reporter!
add graymatter to docs 2023-11-29 18:48:05 +00:00			`---`
			`post_title: Reporting security issues`
			`---`
Initiating the Docs Information Architecture and committing the first major batch of documents We've been quietly building a set of documentation in a private repo that we are ready to move over to the public monorepo so that we can continue our initiative to imrpove the documentation experience for Woo developers. 2023-08-18 18:47:07 +00:00
			`WooCommerce cares deeply about security and works hard to keep our merchants and their customers safe.`

			`You can find our security policy [over here](https://github.com/woocommerce/woocommerce/security/policy) and, if you believe you have discovered a vulnerability, we encourage you to follow it and submit your findings via [HackerOne](https://hackerone.com/automattic?type=team)—a trusted third party service that facilitates reporting of security issues. Please refer to the policy for more details, however some key points are as follows:`

			`- We operate a [bug bounty program](https://hackerone.com/automattic?type=team), so you can be rewarded for valid reports, but not everything is in scope. Please check the guidance before posting.`
			`- We strongly encourage [responsible disclosure](https://www.hackerone.com/disclosure-guidelines). To better protect everyone, please use HackerOne and do not post your findings in a public forum.`

			`Thank you for being a responsible reporter!`