Mahara
External Program
Submit bugs directly to this organization
Mahara
Security is very important to Mahara developers. As potential issues are reported to us, we will test, patch and release fixes as quickly as possible.
In the past, we had a security bug bounty program in place that rewarded researchers for finding security issues and disclosing them to us.
You can see the previous security issues on our bug tracker or subscribe to security announcements from this forum via email or RSS.
The Mahara Security Bug Bounty Program ended in October 2012. Please see the announcement for further information.
We still appreciate security bug reports and will list their reporters in the Security researchers section of our contributors page as a thank you.
Please email security issues to [email protected] and provide as many details as you can about the environment (Mahara version, database version, plugins used, etc.).
Alternatively, you can report security issues on our bug tracker if you select the "Private security" option under "This bug contains information that is" when reporting your bug (which will hide the bug and mark it as private).
You will receive a response from a developer acknowledging receipt of your email, typically within 1 or 2 business days. If you do not receive a response, please do not assume we're ignoring you. It's quite possible your email didn't make it through a spam filter.
We appreciate your patience. Some bugs take time to correct and the process may involve a review of the codebase for similar problems. Please do not disclose the vulnerability to anyone before the publication of the official Mahara security advisory.
When contacting us about a security vulnerability. Let us know whether you want to be listed as a security researcher, and if so, how you should be presented.