Keeping Rock Secure Together Published Oct 2, 2026 For months on Rock Cast, we've been talking about how AI would change security for all software. That shift is here. AI tools are making it easier than ever to find security issues in any platform, and because Rock is open source, anyone can read its code. That openness is one of Rockʼs greatest strengths, and it also means security is something we build together as a community. Hereʼs how that partnership works. What we do We make reporting easy and personal. Our new security reporting tool, Talos, gives anyone who finds an issue a private, two-way conversation with our team. You'll see your report move from investigation to fix to release, and you'll get updates along the way. We turn around fixes quickly and carefully. Every report is triaged fast, and many fixes ship within days. Some take longer, because every church hosts its own Rock server, with different versions and customizations. We take the time to build fixes that protect churches without breaking the systems they depend on every week. Security fixes are applied to the latest two versions of Rock so churches on recent major versions can get protected right away. We communicate with you. We alert you to new security patches so you can update quickly. And with our our new Talos reporting system, we'll communicate with you throughout the process from report to release. We keep details quiet. We don't publicly share the details of security issues. Despite the risk, many churches update on their own schedule, often with small teams or volunteers, and keeping specifics private protects them while they catch up. What you do Update all the way, and keep updating. This is the single most important thing your church can do. Get to the latest version of Rock, then stay in cadence with each release. Every release carries the most current security fixes. Report anything you find through Talos. If you come across something that looks like a security issue, send it through Talos instead of posting it publicly, in Rocket Chat or on social media. That keeps other churches safe while we work on a fix, and it keeps you in the loop from start to finish. Stay up to Date with Best Practices Be sure to keep up with our blog, Rock Cast, and information from our other platforms so you are always knowledgeable about best practices. Start by reading our blog on Rockʼs Field Validation. Ask for help if you need it. Updating can feel like a big lift, especially for a small team. Several Rock Partners offer update services, and you can find them at https://www.rockrms.com/partners. Consider your whole environment. In addition to keeping Rock updated, be sure to keep up to date with server, network and hosting security, manage user permissions and account access and follow best practices for configuring Rock. Stronger together Rock was built by the church, for the church, and keeping it secure works the same way. When our team moves quickly and every church stays current, the whole community is safer. Thank you for being part of it.