Coordinated Disclosure
MongoDB is committed to the security of its products and the protection of customer data. Security researchers, customers, and partners are encouraged to report potential vulnerabilities or incidents related to MongoDB products to help ensure timely resolution.
MongoDB operates a bug bounty program through HackerOne, where eligible security researchers may receive monetary rewards for valid vulnerability reports. MongoDB’s security team reviews and validates all submissions in accordance with the company’s Vulnerability Disclosure Policy.
Further details on submitting a vulnerability report, including the current scope and rewards, can be found on the HackerOne program page.
Privacy
See MongoDB’s Legal Hub for our Privacy Policy and more information on our privacy program.
Disclosure
MongoDB, Inc. requests that security researchers do not publicly disclose any information regarding the vulnerabilities they discover or exploit the issue. MongoDB will take the appropriate steps to analyze the vulnerability, respond to the notification, and notify key users, customers, and partners. The amount of time required to validate a reported vulnerability depends on the complexity and severity of the issue. MongoDB, Inc. takes all required security vulnerabilities very seriously and will always ensure that there is a clear and open channel of communication with the reporter.
Guidelines
Contact Us
For support, please use the MongoDB Support Hub.