Hasura delivers accurate, fast, and secure data access for AI and digital experiences. Trusted by data leaders and developers at Fortune 100 companies and high-growth AI and digital natives.
External Program
Submit bugs directly to this organization
This page describes the Hasura security vulnerability reporting and disclosure process.
Join the Hasura Security Announcements group for emails about security announcements.
We're extremely grateful for security researchers and users who report vulnerabilities to the Hasura community. All reports are thoroughly investigated by the Hasura team.
To report a security issue, please email us at [email protected] with details, if possible attaching relevant information. The more details we have, the quicker will we be able to fix potential vulnerabilities.
In these cases you can join our Discord server where the community will be happy to help you out.
Each vulnerability report is acknowledged and analyzed by the Hasura team within 3 working days.
The reporter will be kept updated at every stage of the issue's analysis and resolution (triage → fix → release).
A public disclosure date in case a vulnerability is discovered is negotiated by the Hasura team and the bug submitter.
We prefer to fully disclose the vulnerability as soon as possible once a user mitigation is available and enough of the affected instances have been upgraded.
It is reasonable to delay disclosure when the vulnerability or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The time frame for disclosure is from immediate (especially if the vulnerability is already publicly known) to a few weeks. Though, we expect the time frame between a report to a public disclosure to typically be in the order of 7 days.
In any case, the Hasura team will do their best to identify and fix any vulnerabilities as soon as possible, as well as communicate to the submitter about the progress and set a disclosure date.