Introduction

Disclosure Policy

• Follow HackerOne's disclosure guidelines.
• Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
• Please provide detailed reports with reproducible steps demonstrating a plausible exploitation scenario.
• Multiple vulnerabilities caused by one underlying issue will be closed as a duplicate.
• The project maintainers have final decision on which issues constitute security vulnerabilities. We will respect their decision, and we ask that you do as well.

Exclusions

While researching, we'd like to ask you to refrain from:

• Denial of service
• Spamming
• Social engineering (including phishing) of developers

Scope

The PoC must work on the master branch of https://github.com/notepad-plus-plus/notepad-plus-plus, or the latest build. Older builds are explicitly out of scope.

POC

Vulnerabilities are to be evaluated given contemporary computer architectures.

The PoC must work on the respective repository trunk heads or the latest released version. Older builds are explicitly out of scope.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Bounties and rewards

Unfortunately, we cannot offer any financial rewards right now, as this project is open-source without any revenue. We hope that public credit listed on our thanks page and the feeling of having done good may be gratifying.

Thank you for helping keep Notepad++ and our users safe!