better-testing

reporting_security.diviner
View Options

			@title Reporting Security Vulnerabilities
			@group intro

			Describes how to report security vulnerabilities in Phabricator.

			Overview
			========

			Phabricator runs a disclosure and award program through
			[[ https://www.hackerone.com/ \| HackerOne ]]. This program is the best way to
			submit security issues to us, and awards responsible disclosure of
			vulnerabilities with cash bounties. You can find our project page
			here:

			(NOTE) https://hackerone.com/phabricator

			The project page has detailed information about the scope of the program and
			how to participate.

			We have a 24 hour response timeline, and are usually able to respond to (and,
			very often, fix) issues more quickly than that.


			Other Channels
			==============

			If you aren't sure if something qualifies or don't want to report via
			HackerOne, you can submit the issue as a normal bug report. For instructions,
			see @{article:Contributing Bug Reports}.


			Get Updated
			===========

			General information about security changes is reported weekly in the
			[[ https://secure.phabricator.com/w/changelog/ \| Changelog ]].