The Zooniverse takes very seriously the security of our websites and systems, and protecting our users and their personal information is our highest priority. We take every precaution to ensure that the information you give us stays secure, but it is also important that you take steps to secure your own account, including:
For general advice and information about staying safe online, please visit:
The Zooniverse supports responsible disclosure of vulnerabilities. If you believe you have discovered a security vulnerability in any Zooniverse software, we ask that this first be reported to security@zooniverse.org to allow time for vulnerabilities to be fixed before details are published.
We believe it is important to be completely transparent about security issues. A complete list of fixed vulnerabilities and past security incidents is given below:
November 13, 2022: Cross-Site Scripting Vulnerability on hosted media domains
November 9, 2020: Cross-Site Scripting Vulnerability in Zoomapper App
April 3, 2020: Caesar Subject Rule Effect Vulnerability
December 11, 2018: Cross-Site Scripting Vulnerability on Project Page's External Links
June 21, 2018: Cross-Site Scripting on Project Home Pages
New vulnerabilities and incidents will be announced via the Zooniverse blog in the "technical" category.