The WeBWorK Project takes security seriously and appreciates responsible disclosure from the community.

If you discover a security vulnerability, please report it privately to:

Email: security@openwebwork.org

Include, if possible:

• A description of the issue
• Affected version(s)
• Steps to reproduce
• Proof of concept or supporting evidence
• Potential impact

Please do not publicly disclose vulnerabilities until the project has had an opportunity to investigate and address them.

All reported security issues will be reviewed by the project maintainers. The maintainers will determine whether a report constitutes a security vulnerability, assess its severity and impact, and prioritize remediation accordingly.

Because The WeBWorK Project is maintained by volunteers and contributors from participating institutions, we do not guarantee a fixed response, assessment, or remediation timeline. Response times will vary depending on the nature of the report, maintainer availability, and the complexity of the issue.

The WeBWorK Project does not assign or publish CVE identifiers. Vulnerabilities may be disclosed through project release notes, security advisories, or other project communication channels as appropriate.

Security fixes are generally provided for:

• Current stable release

Older releases may receive fixes on a best-effort basis.

We ask security researchers to:

• Act in good faith
• Respect user privacy
• Avoid disrupting production systems
• Test only on systems you own or are authorized to assess
• Refrain from social engineering, phishing, or denial-of-service testing

When appropriate, security issues will be addressed through patches, new releases, and security advisories. Instructions for joining the WeBWorK security announcement mailing list are available via the administration interface of your WeBWorK server.