---
title: "Contact"
description: "Where to report a bug, ask a question, or disclose a vulnerability in Workhorse."
canonical: "https://workhorse.run/contact"
---

# Contact

> Where to report a bug, ask a question, or disclose a vulnerability in Workhorse.

Workhorse is maintained by Stablemates in the open, and every channel below is public except the
one for security reports. There is no email address or telephone number yet. When one exists it
will be published here and in the site's structured data.

## Bugs and questions

Open an issue at
[github.com/stablemates/workhorse/issues](https://github.com/stablemates/workhorse/issues). An
issue is the right place for a bug, a question the documentation does not answer, a request for an
integration, or a correction to a page on this site. The maintainers read every issue; a
reproduction shortens the round trip. Include the language and version of the package you use, the
PostgreSQL version, the output of `workhorse schema status` if the schema is involved, and the
smallest program that shows the behaviour.

## Security reports

If you believe you have found a vulnerability, do not open a public issue. Use GitHub's private
vulnerability reporting for the repository at
[github.com/stablemates/workhorse/security/advisories/new](https://github.com/stablemates/workhorse/security/advisories/new).
The report reaches the maintainers privately, and the response process, the supported lines, and
the disclosure policy are in the repository's `SECURITY.md`.

## Contributions

Pull requests are welcome. The repository's `CONTRIBUTING.md` describes the checks a change must
pass, and `CLA.md` is the contributor agreement that Stablemates requires before it merges a
copyrightable contribution. Read both before opening a pull request.

## Where else to look

The [documentation](/docs) answers most questions about behaviour. [Limitations](/docs/limitations)
states what Workhorse does not do. [Releases](/docs/releases) states which versions receive fixes.
The [About](/about) page describes the project and its publisher, and the [privacy notice](/privacy)
describes what this site collects.