Security is very important to us at Read the Docs. We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. In the spirit of transparency, we are committed to responsible reporting and disclosure of security issues.

Account security

  • All traffic is encrypted in transit so your login is protected.

  • Read the Docs stores only one-way hashes of all passwords. Nobody at Read the Docs has access to your passwords.

  • Account login is protected from brute force attacks with rate limiting.

  • While most projects and docs on Read the Docs are public, we treat your private repositories and private documentation as confidential and Read the Docs employees may only view them with your explicit permission in response to your support requests, or when required for security purposes.

  • You can read more about account privacy in our Privacy Policy.

Supported versions

Only the latest version of Read the Docs will receive security updates. We don’t support security updates for custom installations of Read the Docs.

Reporting a security issue

If you believe you’ve discovered a security issue at Read the Docs, please contact us at (optionally using our PGP key). We request that you please not publicly disclose the issue until it has been addressed by us.

You can expect:

  • We will respond acknowledging your email typically within one business day.

  • We will follow up if and when we have confirmed the issue with a timetable for the fix.

  • We will notify you when the issue is fixed.

  • We will add the issue to our security issue archive.

PGP key

You may use this PGP key to securely communicate with us and to verify signed messages you receive from us.

Bug bounties

While we sincerely appreciate and encourage reports of suspected security problems, please note that the Read the Docs is an open source project, and does not run any bug bounty programs.

Security issue archive

You can see all past reports at

Version 3.2.0

Version 3.2.0 resolved an issue where a specially crafted request could result in a DNS query to an arbitrary domain.

This issue was found by Cyber Smart Defence who reported it as part of a security audit to a firm running a local installation of Read the Docs.

Release 2.3.0

Version 2.3.0 resolves a security issue with translations on our community hosting site that allowed users to modify the hosted path of a target project by adding it as a translation project of their own project. A check was added to ensure project ownership before adding the project as a translation.

In order to add a project as a translation now, users must now first be granted ownership in the translation project.