If you believe you have found a security vulnerability in Openfire, please report it privately by email to security@igniterealtime.org.

Please do not disclose security issues through public channels, such as GitHub issues, pull requests, the community forums or chat rooms, until the issue has been addressed.

When reporting, please include as much of the following as you can:

• The version of Openfire that is affected;
• A description of the issue and its potential impact;
• Steps to reproduce the issue, or a proof of concept.

We will acknowledge your report, keep you informed of our progress, and coordinate the public disclosure of the issue with you.