Security Researcher Guide
This guide will help you get started with security research for Passbolt. Whether you're a seasoned security professional or just starting out, this guide will provide you with the information you need to contribute effectively.
Getting Started
- Review our Security Policy
- Learn how to Report a Vulnerability
- Familiarize yourself with our codebase and architecture
What to Look For
When testing Passbolt, focus on these key areas:
- Authentication mechanisms
- Data encryption and key management
- API security
- Browser extension security
- Common web vulnerabilities (XSS, CSRF, etc.)
- Configuration security
- Access control mechanisms
Best Practices
- Always follow responsible disclosure guidelines
- Document your findings thoroughly
- Include steps to reproduce
- Test in a safe environment
- Respect user privacy and data
- Test only on your own installation, not on the public website
- Keep vulnerabilities confidential until they are fixed