Version 1.4, last updated: October 10, 2026
We do our best to make sure our software is free of any security vulnerabilities. The reality though is that it's not always the case. That is why we are very eager and grateful to hear about any issues you find.
Please report these issues directly to our issue tracker (setting issue type to 'Security Problem' to limit visibility).
Reported issues should be related to
Those reporting issues should conform to the following conditions:
All communication and disclosure should be made in a coordinated manner, not putting our business or our users and customers at risk.
A report should include clear reproduction steps, a working PoC where applicable, and evidence of real security impact.
Reports based only on theoretical scenarios, assumptions, or unverified scanner output may be closed without further investigation.
Reports generated using AI-based tools should be reviewed and manually validated before submission.
There should not be any attacks that attempt to access JetBrains or our customers' confidential data.
There should not be any attacks that lead to denial of service attacks on our systems and services or jeopardizing them in any way.
No automated tools should be used for attacking our systems or services.
No social engineering should be targeted against JetBrains employees or customers.
Proof of concept should be drafted using your data when possible.
The impact from the demonstration should be limited to the necessary minimum required to prove the concept.
Where it is not possible to avoid interacting with real users or their data, the impact should be minimized to a few entries where it is absolutely necessary to demonstrate a vulnerability.
The confidentiality, integrity, and availability of our products, services, data, and business processes are to be respected.
We don't have a formal bug bounty program, but depending on the severity of the issue, we often reward reporters based on the issue score that we calculate according to CVSS. We determine the rewards at our discretion and on a case-by-case basis. The available reward options include financial rewards, free licenses for JetBrains products, and mentioning a reporter in the JetBrains Security Bulletin. The issue should not already have been announced publicly or known by JetBrains. This includes issues that we are aware of but have not yet disclosed publicly for whatever reasons.
As soon as possible
Triage reported vulnerabilities as soon as possible depending on their impact.
Prevent further exposure of users data and further exploitation of a security issue.
24 hours from receiving the report
With next release or bug fix update
We release updated products with security fixes with the next release or bug fix update.
Shortly after that we inform our customers about the vulnerability and recommend that they update to a more secure version of the product.
Weeks following
Following quarter