Security Policy

Reporting Vulnerabilities

If you discover a security vulnerability in Tiptap, please report it responsibly. We appreciate your help in keeping our users safe.

How to Report

Please do not report security vulnerabilities through public GitHub issues.

Send details to security@tiptap.dev. Include a description of the vulnerability, steps to reproduce, and any potential impact.

We will acknowledge receipt within 48 hours and provide updates as we investigate.

Response Process

Vulnerabilities are assessed and prioritized based on severity, exploitability, and business impact. Fixes are deployed according to the following timelines:

• Critical (e.g., remote code execution, data breaches): Fixed and released within 24 hours.
• High (e.g., significant data exposure): Fixed and released within 72 hours.
• Medium (e.g., moderate leaks): Fixed and released within 14 days.
• Low (e.g., minor issues): Addressed in the next scheduled update.

We follow responsible disclosure practices and will credit reporters unless requested otherwise.

Scope

This policy applies to all Tiptap packages and related infrastructure. Reports are handled through our established vulnerability management process.

Contact

For questions, email security@tiptap.dev or humans@tiptap.dev.