Please report any security issues you discovered to security[at]rocket[dot]chat

We will assess the risk, plus make a fix available before we create a GitHub issue.

Thank you for your contribution.