
RubyGems
External Program
Submit bugs directly to this organization
Found a security issue with RubyGems or RubyGems.org? Please follow these steps to report it.
If you're having trouble pushing a gem, or otherwise need help with your RubyGems.org account, please send a mail to support address.
Please ensure this is a security issue for the RubyGems client or the RubyGems.org service. This tracker is only for security issues with RubyGems, Bundler, or the RubyGems.org website.
For all vulnerabilities with individual gems, follow our guide on reporting security issues with others' gems. If it's a security issue with the Ruby on Rails framework, see the Rails Security guide.
Please note: the rubygems-developers mailing list, the rubygems.org mailing list, and the Bundler slack are public areas. If escalating to these places, please do not discuss your issue, simply say that you’re trying to get a hold of someone from the security team. Thanks in advance for responsibly disclosing your security issue.
RubyGems and RubyGems.org follow a 5 step disclosure process:
This process can take some time, especially when coordination is required with maintainers of other projects. Every effort will be made to handle the bug in as timely a manner as possible, however it’s important that we follow the release process above to ensure that the disclosure is handled in a consistent manner.
We do not accept reports about third party services we use or our public S3 buckets containing database dumps. For a detailed list of included and excluded scopes, see the Scopes tab.
Do not engage in:
The best way to receive all the security announcements is to subscribe to the rubygems-developers mailing list.
No one outside the core team or the initial reporter will be notified prior to the lifting of the embargo. We regret that we cannot make exceptions to this policy for high traffic or important sites, as any disclosure beyond the minimum required to coordinate a fix could cause an early leak of the vulnerability.
The Internet Bug Bounty awards security research on RubyGems. If your vulnerability meets the eligibility criteria, you can submit the post-fix information to the IBB for payout. As the IBB supports the whole vulnerability lifecycle, these bounty awards are awarded as an 80/20 split, where 80% will go to you, the finder, and 20% will be given to Ruby to continue to support the vulnerability remediation efforts.
To submit eligible vulnerabilities for a payout go to https://hackerone.com/ibb for submission instructions. For bounty rewards, only the rubygems library and rubygems.org domain are in scope.
The project maintainers have final decision on which issues constitute security vulnerabilities. The IBB team will respect their decision, and we ask that you do as well.
If you have any suggestions to improve this policy, please send an email to [email protected].
Thank you for helping keep RubyGems and our users safe!