This document outlines the Responsible Disclosure Program for CometChat.

At CometChat we take security seriously and consider it a top priority. Since a public disclosure of a security vulnerability could put the entire community at risk, we require that potential vulnerabilities are kept confidential until they are confirmed and fixed. We appreciate your efforts in keeping CometChat and its users safe by responsibly disclosing any security vulnerability. Rest assured we will make every effort to acknowledge your contributions.

This policy covers the CometChat UI Kit for Android published from this repository — the chatuikit-core-android, chatuikit-kotlin-android and chatuikit-compose-android libraries and the sample applications — as well as any credentials or sensitive data you may find in the source or its history.

To report any security related issues, please communicate with the CometChat security team by sending an email to security@cometchat.com.

Please include the affected artifact and version (for example com.cometchat:chatuikit-core-android:6.0.7), reproduction steps, and the impact you believe the issue has. Please do not open a public GitHub issue for security reports.