Umami Vulnerability Disclosure

generated: '2026-08-13'
method: searched
source: https://umami.is/security
provider: Umami
providerId: umami
description: Umami publishes a responsible vulnerability disclosure policy on its security page, with a dedicated reporting address, a report-quality checklist and rules of engagement for researchers. It
  is a policy, not a bounty.
policy: https://umami.is/security
bug_bounty:
  operates: false
  statement: '"Umami does not currently operate a guaranteed paid bug-bounty program."'
  platforms_checked:
  - HackerOne
  - Bugcrowd
  - Intigriti
  platforms_found: []
report_should_include:
- The affected product, URL, API endpoint, or software version
- A description of the vulnerability and its potential impact
- Reproduction steps or a proof of concept
- Any relevant logs, screenshots, or request details
- Preferred contact information
rules_of_engagement:
- Do not access, modify, download, or delete customer data
- Do not disrupt Umami Cloud or degrade service availability
- Do not perform denial-of-service, spam, or social-engineering attacks
- Do not test against customer-controlled self-hosted installations without permission
- Use accounts and data that you own whenever possible
- Give Umami a reasonable opportunity to investigate and remediate before public disclosure
advisories:
  channel: GitHub Security Advisories
  url: https://github.com/umami-software/umami/security/advisories
  note: The security page states Umami investigates "reported vulnerabilities and GitHub security advisories" as part of its SDLC. Because Umami is open source under MIT, GitHub advisories are the practical
    disclosure channel for the self-hosted product.
gaps:
- No /.well-known/security.txt on any Umami host (umami.is, api.umami.is, cloud.umami.is, docs.umami.is all miss — see well-known/umami-well-known.yml). The policy exists and the contact exists; only the
  RFC 9116 machine-readable form is missing. This is the cheapest available fix on this artifact.
- No published acknowledgement or remediation timeline.
- No safe-harbor language.
evidence:
- url: https://umami.is/security
  status: 200
- url: https://umami.is/.well-known/security.txt
  status: 404
- url: https://api.umami.is/.well-known/security.txt
  status: 405
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
policy_detail:
  published: true
  url: https://umami.is/security
  section: Responsible vulnerability disclosure
  contact: security@umami.is
  contact_kind: email
  scope: 'Umami and Umami Cloud. Explicitly OUT of scope: customer-controlled self-hosted installations, which must not be tested without the operator''s permission.'
  statement: '"We welcome reports from security researchers and customers who believe they have discovered a vulnerability in Umami or Umami Cloud."'
  response_commitment: '"We will review good-faith reports and keep the reporter informed as the issue is investigated." No numeric acknowledgement or remediation SLA is published.'
  safe_harbor: not_stated