The Matomo Security Bug Bounty Program is designed to encourage security research in Matomo software and to reward those who help us create the safest web analytics platform. The bounty for valid critical security bugs is a $777 (US) cash reward. The bounty for non-critical bugs is $333 (US), paid via Paypal.

We encourage you to responsibly report issues via our Matomo Bug Bounty Program on HackerOne or you can also email us at [email protected].

If you have found a security issue in Matomo please read our security notes regarding responsible disclosures.

Secure Matomo server: follow these steps to keep your Matomo data safe.

Please subscribe to the Changelog (rss feed) to be notified of new releases (including security releases).