If you believe you've discovered a security issue in RT, please send an email to security@bestpractical.com with a detailed description of the issue, and a secure means to respond to you (such as your PGP public key). You can find our PGP key and fingerprint at https://bestpractical.com/security/.