This document outlines the Responsible Disclosure Program for CometChat.

At CometChat we take security seriously and consider it a top priority. Since a public disclosure of a security vulnerability could put the entire community at risk, we require that potential vulnerabilities are kept confidential until they are confirmed and fixed. We appreciate your efforts in keeping CometChat and its users safe by responsibly disclosing any security vulnerability. Rest assured we will make every effort to acknowledge your contributions.

To report any security related issues, please communicate with the CometChat security team by sending an email to security@cometchat.com.

Please include as much detail as possible — affected version, reproduction steps, and impact — so we can triage quickly.

• We will acknowledge your report within 3 business days.
• We will provide an assessment and expected remediation timeline within 10 business days of acknowledgement.
• We will keep you informed of progress toward a fix and notify you when the vulnerability is resolved.
• We ask that you give us a reasonable opportunity to remediate before any public disclosure.