Security issues should not be posted on the forums, as this is a public venue and the information may be abused. We prefer to follow a responsible disclosure procedure.
There are two distinct entities with their own areas of responsibility to consider:
- There is the OpenVPN community, which develops and maintains the open source OpenVPN protocol and the open source OpenVPN GUI program for Windows, and has its own community wiki for documentation.
- There is the OpenVPN Inc. company, which develops and maintains the main website and commercial products such as OpenVPN Access Server, CloudConnexa, and OpenVPN Connect.
It is appreciated if you report any security issues to the correct party.
Reporting security issues for open source projects
Contact the OpenVPN open source community to report security issues for any of the following projects:
- OpenVPN2 and OpenVPN3 open source projects.
- OpenVPN GUI for Windows client.
- OpenVPN protocol itself.
- Other open source clients (TunnelBlick, OpenVPN for Android).
Please include information on what the issue is, how to reproduce it, and any potential impact. Do not use this email address for any other purpose than reporting security issues.
Contact us at: security@openvpn.net
You may encrypt your message with our security mailing list key.
Reporting security issues for commercial products
Contact OpenVPN Inc. to report compliance or security issues for any of the following commercial products:
- OpenVPN Access Server.
- OpenVPN CloudConnexa.
- OpenVPN Connect.
- Website or infrastructure related items.
Please include information on what the issue is, how to reproduce it, and any potential impact.
Contact us at: security@openvpn.com
