content_image/728566.jpg content_image/728568.jpg
You may encrypt email using MongoDB’s public key at https://docs.mongodb.org/10gen-security-gpg-key.asc. 

MongoDB, Inc. responds to vulnerability reports sent via email with a response email that contains a reference number for a JIRA ticket posted to the SECURITY 80 project. 

## Evaluation of a Vulnerability Report 

MongoDB, Inc. validates all submitted vulnerabilities and uses Jira to track all communications regarding a vulner- ability, including requests for clarification or additional information. If needed, MongoDB representatives set up a conference call to exchange information regarding the vulnerability. 

## Disclosure 

MongoDB, Inc. requests that you do not publicly disclose any information regarding the vulnerability or exploit the issue until it has had the opportunity to analyze the vulnerability, to respond to the notification, and to notify key users, customers, and partners. 

The amount of time required to validate a reported vulnerability depends on the complexity and severity of the issue. MongoDB, Inc. takes all required vulnerabilities very seriously and will always ensure that there is a clear and open channel of communication with the reporter. 

After validating an issue, MongoDB, Inc. coordinates public disclosure of the issue with the reporter in a mutually agreed timeframe and format. If required or requested, the reporter of a vulnerability will receive credit in the published security bulletin. 

## 6.4 Security Reference 

## 6.4.1 Security Methods in the mongo Shell 

<img src='content_image/728566.jpg'>

## User Management Methods 

<img src='content_image/728568.jpg'>

