Edit File by line

# Security Policy

[0] Fix | Delete

[1] Fix | Delete

Full details of the Automattic Security Policy can be found on [automattic.com](https://automattic.com/security/).

[2] Fix | Delete

[3] Fix | Delete

## Supported Versions

[4] Fix | Delete

[5] Fix | Delete

Generally, only the latest version of Jetpack and its associated plugins have continued support. If a critical vulnerability is found in the current version of a plugin, we may opt to backport any patches to previous versions.

[6] Fix | Delete

[7] Fix | Delete

## Reporting a Vulnerability

[8] Fix | Delete

[9] Fix | Delete

Our HackerOne program covers the below plugin software, as well as a variety of related projects and infrastructure:

[10] Fix | Delete

[11] Fix | Delete

* [Jetpack](https://jetpack.com/)

[12] Fix | Delete

* Jetpack Backup

[13] Fix | Delete

* Jetpack Boost

[14] Fix | Delete

* Jetpack CRM

[15] Fix | Delete

* Jetpack Protect

[16] Fix | Delete

* Jetpack Search

[17] Fix | Delete

* Jetpack Social

[18] Fix | Delete

* Jetpack VideoPress

[19] Fix | Delete

[20] Fix | Delete

**For responsible disclosure of security issues and to be eligible for our bug bounty program, please submit your report via the [HackerOne](https://hackerone.com/automattic) portal.**

[21] Fix | Delete

[22] Fix | Delete

Our most critical targets are:

[23] Fix | Delete

[24] Fix | Delete

* Jetpack and the Jetpack composer packages (all within this repo)

[25] Fix | Delete

* Jetpack.com -- the primary marketing site.

[26] Fix | Delete

* cloud.jetpack.com -- a management site.

[27] Fix | Delete

* wordpress.com -- the shared management site for both Jetpack and WordPress.com sites.

[28] Fix | Delete

[29] Fix | Delete

For more targets, see the `In Scope` section on [HackerOne](https://hackerone.com/automattic).

[30] Fix | Delete

[31] Fix | Delete

_Please note that the **WordPress software is a separate entity** from Automattic. Please report vulnerabilities for WordPress through [the WordPress Foundation's HackerOne page](https://hackerone.com/wordpress)._

[32] Fix | Delete

[33] Fix | Delete

## Guidelines

[34] Fix | Delete

[35] Fix | Delete

We're committed to working with security researchers to resolve the vulnerabilities they discover. You can help us by following these guidelines:

[36] Fix | Delete

[37] Fix | Delete

* Follow [HackerOne's disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).

[38] Fix | Delete

* Pen-testing Production:

[39] Fix | Delete

* Please **setup a local environment** instead whenever possible. Most of our code is open source (see above).

[40] Fix | Delete

* If that's not possible, **limit any data access/modification** to the bare minimum necessary to reproduce a PoC.

[41] Fix | Delete

* **_Don't_ automate form submissions!** That's very annoying for us, because it adds extra work for the volunteers who manage those systems, and reduces the signal/noise ratio in our communication channels.

[42] Fix | Delete

* To be eligible for a bounty, all of these guidelines must be followed.

[43] Fix | Delete

* Be Patient - Give us a reasonable time to correct the issue before you disclose the vulnerability.

[44] Fix | Delete

[45] Fix | Delete

We also expect you to comply with all applicable laws. You're responsible to pay any taxes associated with your bounties.

[46] Fix | Delete

[47] Fix | Delete