We only add security updates to the latest MAJOR.MINOR version of the project. No security updates are backported to previous versions. If you
want be up to date on security patches, make sure your Plausible image is up to date with plausible/analytics:latest
If you've found a security vulnerability with the Plausible codebase, you can disclose it responsibly by sending a summary to security@plausible.io. We will review the potential threat and fix it as fast as we can.
While we do not have a bounty program in place yet, we are incredibly thankful for people who take the time to share their findings with us. Whether it's a tiny bug that you've found or a security vulnerability, all reports help us to continuously improve Plausible for everyone. Thank you!