---
title: "Reporting a Vulnerability"
---

> Documentation Index
> Fetch the complete documentation index at: https://contribute.freecodecamp.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Reporting a Vulnerability

> **Security is important to us**
>
> Found a vulnerability? **Report it responsibly**. Don't create public GitHub issues for security problems. Follow this guide instead.

## What We Accept Reports For

We only accept vulnerability reports for these platforms:

| App                 | Type        | Website active                                                                                                              |
| ------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------- |
| Learning platform   | Web         | `freecodecamp.org/learn`                                                                                                    |
| Publications        | Web         | `freecodecamp.org/news`, `freecodecamp.org/<language>/news`, etc.                                                           |
| freeCodeCamp Mobile | Mobile      | `https://play.google.com/store/apps/details?id=org.freecodecamp`, `https://apps.apple.com/us/app/freecodecamp/id1442777773` |
| DeveloperQuiz       | Web         | `developerquiz.org`                                                                                                         |
| LearnToCodeRPG      | Mobile      | `https://play.google.com/store/apps/details?id=org.freecodecamp.learntocoderpg`                                             |
| freeCodeCamp API    | API/Service | `api.freecodecamp.org`                                                                                                      |
| Socrates            | API/Service | `socrates.freecodecamp.org`                                                                                                 |
| Donations           | Web         | `donate.freecodecamp.org`                                                                                                   |

## Other Platforms & Self-Hosted Services

- We self-host some platforms using Open Source software. Only report vulnerabilities in our specific setup and configuration, contact upstream projects for other issues.
- Additionally, we may selectively accept reports for some freeCodeCamp GitHub repositories, which we use actively in production.

## Research Guidelines

Follow these guidelines when testing and reporting vulnerabilities:

### Rules

- Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
- Never attempt non-technical attacks such as social engineering, phishing, or physical attacks against our employees, users, or infrastructure.
- Perform testing only on our official platforms listed above.
- Do not attempt to access or modify user data without permission other than your own. Stop immediately if you find sensitive user data.
- Do not use automated tools that could cause service disruption or violate our terms of service.

### Report Requirements

Your report should include:

- **Clear and detailed steps** to reproduce the vulnerability.
- **Impact description** - what could an attacker do?
- **Evidence** - screenshots, code, or examples.
- **Environment** - browser, OS, configuration

Here are some examples of valid and invalid reports:

**Valid:**

- Authentication bypass
- SQL injection exposing user data
- XSS affecting multiple users
- Remote code execution vulnerabilities

**Invalid:**

- SSL scanner warnings
- Clickjacking on non-sensitive pages
- Issues requiring local machine access
- Vulnerabilities requiring admin privileges

## What We Don't Accept

### Automated Reports & "Beg Bounties"

- Generic tool output without manual verification
- SSL/DNS configuration warnings
- Dependency alerts without proof of exploit
- Subdomain enumeration lists
- AI-generated reports without manual verification.

We treat low-effort reports as ["beg bounties"](https://www.troyhunt.com/beg-bounties). These are reports that don't meet our quality standards or are not actionable.

### Low-Impact Issues

- Self-exploitation vulnerabilities like installing a malicious extension
- Issues requiring extensive social engineering
- Theoretical vulnerabilities without real impact
- Problems only affecting outdated OS or browsers

### Third-Party & Non-Security Issues

- Vulnerabilities in services we don't control
- Known upstream software issues
- Regular bugs, Feature requests & Content violations
- Physical access requirements

## How to Report

**Email your report** to `possible-security-issue [at] freecodecamp.org`.

**We will acknowledge** the report, check if it's in scope and let you know if we need more information.

**We will analyze** the report and may ask for more details for investigation.

**We will fix** confirmed issues and coordinate disclosure timing with you

**We will recognize** valid reports in our [Hall of Fame](/security-hall-of-fame/).

> **Notes**
>
> - You may send us separate reports for each vulnerability.
> - Factors like complexity and responsiveness can affect timing.
> - We prioritize user safety and thoroughness over speed.
> - We will not respond to reports that don't meet our guidelines or are out of scope.

## Timeline

- **Acknowledgement**: Within 48-72 hours
- **Initial Assessment**: Within 5-7 business days
- **Updates**: During investigation as needed
- **Disclosure**: Within 90 days maximum

## Recognition

We don't offer any bounties, but we maintain a [Hall of Fame](/security-hall-of-fame/) for researchers who submit high-effort and good-quality reports.

Source: https://contribute.freecodecamp.org/security/index.mdx