# Security Policy

## Reporting a Vulnerability

We welcome security researchers and users who report vulnerabilities they discovered in CatBoost. All reports are thoroughly investigated.

To report a potential vulnerability in CatBoost please use the special `Report a vulnerability` button on https://github.com/catboost/catboost/security page or contact administators of [the CatBoost Telegram chat](https://t.me/catboost_en) privately.

### When Should I Report a Vulnerability?

- You think you discovered a potential security vulnerability in CatBoost
- You are unsure how a vulnerability affects CatBoost

## Security Vulnerability Response

Each report is acknowledged and analyzed by CatBoost maintainers within 5 working days.
We will keep the reporter informed about the issue progress.

## Public Disclosure Timing

A public disclosure date is negotiated by CatBoost maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a mitigation is available for CatBoost users. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days.