Security Policy

Supported Versions

We actively support the following versions of Evolution API with security updates:

We take security vulnerabilities seriously. If you discover a security vulnerability in Evolution API, please help us by reporting it responsibly.

Please DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security vulnerabilities via email to:

When reporting a vulnerability, please include:

We will acknowledge receipt of your vulnerability report within 48 hours and will send you regular updates about our progress.

This security policy applies to:

The following are generally considered out of scope:

Third-party integrations (Chatwoot, Typebot, etc.) - please report to respective projects
Issues in dependencies - please report to the dependency maintainers
Social engineering attacks
Physical attacks
Denial of Service attacks

We believe in recognizing security researchers who help us keep Evolution API secure:

We will acknowledge your contribution in our security advisories (unless you prefer to remain anonymous)
For significant vulnerabilities, we may feature you in our Hall of Fame
We will work with you on coordinated disclosure timing

For users deploying Evolution API:

Security updates will be:

For any questions about this security policy, please contact:

Thank you for helping keep Evolution API and our community safe! 🛡️