Security at Geonode

We take the security of our platform and our users' data seriously. If you believe you've found a security vulnerability in any Geonode service, we want to hear from you.

How to report

Email us at security@geonode.com with:

• A description of the vulnerability and its potential impact
• Steps to reproduce it
• Any relevant screenshots, logs, or timestamps
• Your name or handle. You're welcome to report anonymously, but note that to pay a bounty we need your real name and payment details. Anonymous reports are still reviewed and appreciated.

We'll acknowledge your report within 5 business days.

Scope

In scope:

• geonode.com and all subdomains
• repocket.com and all subdomains
• The Geonode dashboard and customer API
• Geonode proxy infrastructure

Out of scope:

• Denial of service (DoS/DDoS) testing
• Social engineering, phishing, or physical attacks
• Third-party services we integrate with but do not operate
• Automated scanner output without a demonstrated, reproducible vulnerability
• Issues with no realistic security impact (e.g. missing security headers on static pages, clickjacking on pages with no sensitive actions)

Rules of engagement

• Do not access, copy, download, or share data that isn't yours. If you encounter user or customer data, stop, report it, and delete anything you may have retrieved.
• Do not degrade or disrupt our services.
• Do not publicly disclose the issue until we've resolved it and agreed on disclosure together.
• Only test against your own accounts.

Safe harbor

We will not pursue legal action against researchers who act in good faith, follow the rules above, and report vulnerabilities to us directly. We consider good-faith security research authorized under this policy.

Recognition and rewards

We appreciate the time and effort security researchers put into helping keep Geonode and our users safe.

We may offer monetary rewards for valid, responsibly disclosed security vulnerabilities at our discretion. We do not operate a guaranteed bug bounty program, and there is no fixed reward amount or guaranteed payment.

We review each report individually, considering the vulnerability’s severity, demonstrated security impact, reproducibility, and the quality of the report. The Geonode team decides whether to offer a reward and how much on a case-by-case basis.

Duplicate reports, issues we already know about, and out-of-scope findings are generally not eligible for rewards. The same applies to theoretical vulnerabilities without demonstrated impact and automated scan results that do not show a reproducible security issue.

If we approve a reward, we’ll contact you directly to discuss the details and any information we need to process payment.

Thank you for helping us make Geonode more secure.