All security bugs in Tuleap should be reported by emailing [email protected].

A member of our security team will your vulnerability report within 3 business days, and you will receive a response indicating the next steps in handling your report.

Vulnerabilities in third-party applications should be reported to their respective maintainers. The Tuleap security team is not responsible for the security of these applications but will attempt to contact the third-party maintainer if an issue is brought to his attention.

The provided email address to send vulnerability reports supports hop-by-hop encryption. If you feel the report needs end-to-end encryption please reach out to us, we will try to find a solution accommodating everyone involved.

Any efforts made for improving the security of the Tuleap software or its users will be greatly appreciated by the Tuleap community. If you want your disclosure will be publicly acknowledged in the public report. Please refrain from requesting compensation for reporting vulnerabilities. At this time the Tuleap project does not deliver bounties.

Issues not affecting the security of the Tuleap software but of one of the services managed for the Tuleap community (such as issues affecting the tuleap.org website) can be reported under the same guidelines but do not warrant a public acknowledgment. SPF, DKIM, or DMARC issues in one of the services managed for the Tuleap community must not be reported.

The Tuleap community would be grateful if security researchers comply with the following guidelines while researching and reporting vulnerabilities:

• Do not test for vulnerabilities on instances you do not own. Tuleap is an open-source software, you can install your own copy or use our Docker image to quickly get a playground.
• Confirm the vulnerability exists in the most recent stable or development version.
• Allow the security team enough time to correct the reported vulnerability before publicly identifying or disclosing it.

Our security team follows the following guidelines:

• Vulnerability reports can take some time to be resolved but every effort will be made to handle a bug in as timely a manner as possible.
• Advisories for the reported vulnerabilities are made public in the Tuleap bug report tracker. You can find more information on how we handle vulnerabilities in our vulnerability response guide.
• Security researchers and their findings are respected and will be publicly acknowledged if they wish.
• No legal threats nor punitive actions against security researchers for reporting vulnerabilities will be made.