# Report a vulnerability > How to report a security vulnerability in Home Assistant privately, what qualifies, and what happens after you report. Source: https://contributors.home-assistant.io/security/report-a-vulnerability/ Found a security vulnerability in Home Assistant? Thank you for taking the time. This page sums up the official [security policy](https://www.home-assistant.io/security/), section by section, with a link to each one. If anything here differs from the policy, the policy wins. ## Report it privately Report the vulnerability through [GitHub's security advisory form](https://github.com/home-assistant/core/security/advisories/new) of the core repository. Only you and the maintainers can see it. This is called [coordinated disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure): the project gets time to fix the problem before the details go public. Never report a vulnerability in a public issue, a pull request, a forum post, or a chat channel. Details in public give attackers a head start on every home that has not updated yet. The same goes when you find something as a contributor: in a pull request you review, in code you work on, or in a dependency. Report it privately first, and leave the public discussion for after the fix. Policy: [Reporting a vulnerability](https://www.home-assistant.io/security/#reporting-a-vulnerability). ## What to include The policy asks you to describe a clear and realistic impact. A good report answers: - What is affected: which part of Home Assistant, and which version - What an attacker needs: network access, an account, or anything else - How to reproduce it, step by step - What the attacker gains The project is mostly interested in reports from people who use Home Assistant and know it well, but all high quality reports are welcome. ## Severity scoring If you know [CVSS 3.1](https://www.first.org/cvss/v3.1/specification-document), add a score to your report as a vector string. The [calculator](https://www.first.org/cvss/calculator/3.1) helps. If you are unsure how to score it, or cannot, say so in your report, and the project looks into it. Only add a score if you are familiar with CVSS. The policy recommends reading the [specification](https://www.first.org/cvss/v3.1/specification-document) and the [scoring guide](https://www.first.org/cvss/v3.1/user-guide#Scoring-Guide) first: reports that use CVSS incorrectly are not accepted. Policy: [Severity scoring](https://www.home-assistant.io/security/#severity-scoring). ## What happens next - The project does its best to respond within 7 days, and to keep you informed while the issue gets resolved. Home Assistant relies heavily on volunteers, so a reply can take longer than you would like. - Give the project at least 90 days to release a fix, and do not make the vulnerability public without notifying the project first. - For a valid vulnerability that meets the [criteria below](https://contributors.home-assistant.io/security/report-a-vulnerability/#public-disclosure-and-cve-assignment), the project publishes a GitHub security advisory. - Published advisories are listed under [past advisories](https://www.home-assistant.io/security/#past-advisories) on the security page. The [past advisories reference](https://contributors.home-assistant.io/security/reference/advisories/) groups them by kind, with the lesson of each. Policy: [Reporting a vulnerability](https://www.home-assistant.io/security/#reporting-a-vulnerability). ## Supported versions Reports are only accepted against the latest stable, official version of Home Assistant, or a newer version that is in development or beta test. Find the latest version on the [releases page](https://github.com/home-assistant/core/releases). Reports against forks of Home Assistant are not accepted. Policy: [Supported versions](https://www.home-assistant.io/security/#supported-versions). ## What does not qualify These types of reports are not accepted: - Reports from automated tools or scanners - Theoretical attacks without proof that they can be exploited - Attacks that come from a third-party application or library (report those to its maintainers) - Social engineering - Attacks that need access to the host system that Home Assistant runs on - Attacks that need physical access to a user's device, or a device or network that is already seriously compromised, like a man-in-the-middle - Attacks that need the user to install other, malicious software, like a third-party integration (a [custom integration](https://contributors.home-assistant.io/glossary/custom-integration/)), an [app](https://contributors.home-assistant.io/glossary/app/), or a plugin - Attacks that users can only perform against their own setup - Privilege escalation by logged-in users That last one surprises people. The policy explains why: Home Assistant assumes every user is trusted and does not enforce user privileges. It assumes every logged-in user has the same access as an owner account. The user documentation explains this under [user accounts](https://www.home-assistant.io/docs/authentication/#user-accounts). Policy: [Non-qualifying vulnerabilities](https://www.home-assistant.io/security/#non-qualifying-vulnerabilities). ## Public disclosure and CVE assignment The project publishes a GitHub security advisory, and requests a CVE through it, for a valid vulnerability that: - Is in Home Assistant itself, not in a third-party library - Was not already known to the project - Was not already known to the public A CVE is only requested when the severity is medium or higher. Policy: [Public disclosure & CVE assignment](https://www.home-assistant.io/security/#public-disclosure--cve-assignment). ## Bounties Home Assistant is an open source project and cannot offer bounties for security vulnerabilities. If you want, you are credited as the discoverer of the vulnerability. Policy: [Bounties](https://www.home-assistant.io/security/#bounties). ## Writing about security If you plan to write about the security of Home Assistant, the policy asks you to get in touch at [hello@home-assistant.io](mailto:hello@home-assistant.io) first, so all claims can be checked. ## Related - [How Home Assistant handles trust](https://contributors.home-assistant.io/security/how-it-works/): the trust model of the system. - [Past advisories](https://contributors.home-assistant.io/security/reference/advisories/): what went wrong before, and what to learn from it. - [Security policy](https://www.home-assistant.io/security/): the official policy, and the full list of past advisories.