Zulip

Open source team chat organized around topic-based threading, which keeps busy conversations easier to follow than channel-only tools. Can be self-hosted, or used as a paid cloud service. The threading model takes some getting used to.

Open Source

Zulip Source Code

Author

zulip

Description

Zulip server and web application. Open-source team chat that helps teams stay productive and focused.

#apache#chat#collaboration#electron#foss#free#javascript#python#python3#react-native#slack#zulip

Homepage

https://zulip.com

Repository

  • LicenseApache-2.0
  • Created25 Sept 15
  • Primary languagePython
  • Size648,959 KB
  • Stars26,110
  • Forks10,475
  • Watchers26,110

Language Usage

Language Usage

Project Health

Top Contributors

Recent Commits

  • Niloth P(14 Oct 26)

    webhooks/docs: Document how integrations support event filtering. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

  • Niloth P(14 Oct 26)

    test_classes: Require webhooks with event types to pass them. For webhooks that support event filtering: - WebhookTestCase already checks that the event type is declared. - This new check ensures they respect it by including the event_type in every call to check_send_webhook_message. New Relic's warning on a misconfigured payload template isn’t event‑bound, so it now passes complete_event_type=None explicitly. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

  • Niloth P(14 Oct 26)

    integration-docs: Add missing event-filtering sections. For the integrations that support event-filtering. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

  • Niloth P(14 Oct 26)

    webhooks: Fix event filters being ignored. Fixes #40213. Co-Authored-By: Fadi Romdhan <[email protected]> Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

  • Prakhar Pratyush(23 Oct 26)

    portico: Replace the word "logo" with "icon" for communities directory. The directory displays each organization's icon, which `communities_view` fetches with `get_realm_icon_url`, but calls it a "logo" everywhere when used in the template. An organization's logo is a different image, served by `get_realm_logo_url`. This commit replaces the term "logo" with "icon" for communities directory. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Prakhar Pratyush <[email protected]>

  • Shubham Padia(13 Oct 26)

    skills: Add evals for the write-changelog skill. These let an agent check a change to the skill's wording, or a new model, against changelog entries the maintainers published. The README gives the cases, the procedure and the prompts. There is no runner script. An agent can write one from the README. Co-Authored-By: Claude Opus 5.5 <[email protected]>

  • Shubham Padia(09 Oct 26)

    skills: Keep write-changelog maintenance entries short. Entries drafted for maintenance releases were longer than the published ones. They explained how a bug happened and how it was fixed, and named internals like migration numbers. Tell the skill to describe only the effect, in one clause of about ten words. Before finishing, it shortens entries that are clearly longer than those in the previous maintenance release. The rule is in the maintenance release section only. As a general style rule, it made the skill shorten existing major release bullets, which made some of them wrong. Evals on the same releases chose this rule. A model compared the old and new skill's entries with the published entry, and picked the new one about 60% of the time. Example entries and a subagent that edits the draft did not help. Co-Authored-By: Claude Opus 5.5 <[email protected]>

  • Shubham Padia(09 Oct 26)

    skills: Check write-changelog entries against their commits. The skill wrote entries that sounded right but misstated a detail. For example, it wrote "Fixed a crash in the organization exports UI" for a bug where the data exports panel failed to load. Add a step where a fresh subagent reads the diffs and tries to refute each new entry. Also add a check of existing bullets that the update rewords, or that state a limitation, since those were written against older code. The step was chosen with evals on six past maintenance releases. A model drafted each release's section with a candidate skill, and a second model checked every entry against the code. It flagged 6% of the entries from the old skill, and about 1% with the subagent step. Asking the drafter to check its own entries made no difference. Co-Authored-By: Claude Opus 5.5 <[email protected]>

  • Shubham Padia(19 Oct 26)

    marketing: Track which marketing buttons get clicked. Google Analytics doesn't record clicks on links within our site. So it can't tell which "Get started" button on /slack-alternative/ people use, since they all go to /. Elements with the analytics-click class now send a marketing_click event with their data-button-id. The ID needs to be registered as a custom dimension in Google Analytics before it shows up in reports. Co-Authored-By: Claude Opus 5.5 <[email protected]>

  • Shubham Padia(04 Sept 26)

    marketing: Link to the Slack alternative page. Add links from the footer, the home page, and /why-zulip/, so that the new page is reachable from the rest of the site and gets crawled. The Product menu entry is left for a follow-up once the page is deployed, because the marketing nav uses absolute zulip.com URLs, and the documentation crawler checks those against the live site. Co-Authored-By: Claude Fable 5.1 <[email protected]>

  • Shubham Padia(04 Sept 26)

    marketing: Add /slack-alternative/ landing page. This page is for people who are looking for an alternative to Slack and don't know Zulip yet. The title and description lead with "Slack alternative", with Zulip only as a suffix, since the target reader isn't searching for Zulip yet. The customer logos are the same images the home page uses. They live in svg_icons.css, which is about 120KB. The other marketing pages don't need that file, so this page gets its own webpack bundle instead of adding the file to the shared marketing-page bundle. This page caps feature images at their container width to prevent overflow on narrow screens. Other marketing pages can be addressed in a follow-up issue. Co-Authored-By: Claude Fable 5.1 <[email protected]>

  • Shubham Padia(10 Sept 26)

    marketing: Share the alternating section background rule. This is a prep commit for the next commit. Co-Authored-By: Claude Fable 5.1 <[email protected]>

  • Shubham Padia(22 Oct 26)

    portico: Share the home page quote text color. Move the quote text color into portico_variables.css, so that other marketing pages can use it too. The home page now loads that file. Co-Authored-By: Claude Opus 5.5 <[email protected]>

  • Shubham Padia(22 Oct 26)

    portico: Crop empty space from the Pilot client logo. The Pilot logo SVG had about 23px of empty space on every side. This makes the logo look small when it's scaled to fit a box. /hello looks the same, because it centers the logo at its natural size. Co-Authored-By: Claude Opus 5.5 <[email protected]>

  • Alex Vandiver(16 Oct 26)

    help: Fall back to unoptimized images if sharp cannot load. The prebuilt sharp binaries refuse to load on CPUs without x86-64-v2 support. This includes older hardware, as well as virtual machines using a generic CPU model such as kvm64 on newer hardware. Astro reports this as "MissingSharp: Could not find Sharp", hiding sharp's actual "Unsupported CPU" error, and the help center build failure aborts the upgrade. Since bundled releases include a pre-built version of the help center, this failure mode only occurs when upgrading with `upgrade-zulip-from-git`. If sharp fails to load, build the help center with Astro's passthrough image service, and print sharp's "Unsupported CPU" error so the cause is discoverable. For these virtualized or older hosts, help center images are served as the original unoptimized PNGs rather than as optimized WebP, at slightly higher filesize (currently a sum of 1.38MB, vs 533KB). Co-Authored-By: Claude Opus 5.5 <[email protected]>

  • Evy Kassirer(12 Oct 26)

    events: Use pydantic types for message and update_message events. These are the last events built as dicts. Both carry the per-recipient notification inputs that process_message_event and process_message_update_event consume and never forward. The message event always sets them, so they are required there; update_message sets them only for content edits, so they are optional there. The message event is not a subclass of the model clients receive: its message field is the message id and message_dict the wide dict, which Tornado finalizes per client. The update_message event shares UpdateMessageOptionalFields with the model clients receive, split out of UpdateMessageEvent for that purpose, and declares the required fields itself: it leaves out flags, which Tornado adds per recipient, and makes message_ids optional, since do_update_message only knows it after applying the edit to every affected message. The event is otherwise filled in by attribute assignment where the dict used to be mutated. propagate_mode gets a PropagateMode alias in zerver.lib.types so the view, the edit request and the event agree on its type. The tests that mock send_event_on_commit read the event as an object now instead of a dict. Co-Authored-By: Claude Fable 5.1 <[email protected]>

  • sandeep(07 Sept 26)

    settings: Structure the notification sound preview as a button. The control was a '<span>' with a click handler, so it could not be reached from a keyboard. Render it with the 'icon_button' component instead, which also lets the flex row center it without the 'line-height' hack. Fixes part of #36224.

  • sandeep(07 Sept 26)

    icons: Replace FontAwesome icons with Zulip icons in settings. Replace decorative FontAwesome icons in the settings panels with their Zulip equivalents: - 'fa-ellipsis-v' to 'zulip-icon-grip-vertical' - 'fa-info-circle' to 'zulip-icon-info' - 'fa-question-circle' to 'zulip-icon-help' - 'fa-play-circle' to 'zulip-icon-play-circle' The drag handles used two 'fa-ellipsis-v' icons side by side. A single 'zulip-icon-grip-vertical' draws the same two columns of dots, and is already the drag handle in the poll and todo modals. The Zulip glyphs are drawn at a different scale, so the icons are resized and seated against the text beside them. The info icons swap their 'position: relative' nudge for a 'vertical-align' that scales with the label or heading, leaving one mechanism instead of two. All four info icons now carry 'aria-hidden'; they only open a tooltip beside a label that already names the setting. Fixes part of #36224.

  • sandeep(07 Sept 26)

    icons: Redesign play-circle.svg to match the other circular icons. The icon was drawn at 24x24 with strokes, so it looked bolder than the 16x16 filled circular icons beside it, like 'help' and 'info'. Redraw it at 16x16 as a filled icon. This changes it everywhere: the user card and personal menu popovers today, and the notification sound preview once that moves to it. Fixes part of #36224.

  • Ishan Kumar(13 Oct 26)

    recent_view: Remove unused filter_muted template parameter. The "Include muted" filter button was replaced by the topic filter dropdown in 1e7b4ae160, and recent_view_filters.hbs no longer reads filter_muted, so stop passing it.

  • Sahil Batra(21 Oct 26)

    bots: Fix owner change text in reactivation modal. The statement to unsubscribe bot from accessible streams when the owner is being changed after reactivation is no longer true after e57c43b705.

  • Anders Kaseorg(21 Oct 26)

    requirements: Upgrade Python requirements. Signed-off-by: Anders Kaseorg <[email protected]>

  • Anders Kaseorg(21 Oct 26)

    ruff: Fix RUF071 `os.path.commonprefix()` compares strings character-by-character. Signed-off-by: Anders Kaseorg <[email protected]>

  • Anders Kaseorg(21 Oct 26)

    install-uv: Upgrade uv from 0.12.19 to 0.13.4. Signed-off-by: Anders Kaseorg <[email protected]>

  • Pinank Shah(04 Sept 26)

    typeahead: Use grid layout for typeahead content. Replace the flex layout with named grid areas for the optional leading icon or avatar and the typeahead text content. Use a single content column for suggestions without a leading icon so text-only entries do not reserve an empty column or extra gap. Fixes #37030.

  • Karl Stolley(12 Oct 26)

    subscriptions: Keep focus ring within button area.

  • Karl Stolley(12 Oct 26)

    subscriptions: Target icon for desired size.

  • Shubham Padia(30 Jun 26)

    markdown: Match topic-link rendering in the web app local echo. Mirror the backend change in the web app's Markdown so local echo and the server's stored render agree: handleStreamTopic and handleStreamTopicMessage now leave a non-empty topic link as plain text when the channel only allows the empty topic. The check is exposed to the shared Markdown code via a new is_empty_topic_only_channel helper on MarkdownHelpers, wired in the web app to stream_data.is_empty_topic_only_channel. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

  • Shubham Padia(30 Jun 26)

    markdown: Don't linkify named topics in empty-topic-only channels. A `#**channel>topic**` (or `…@id`) link to a non-empty topic in an empty-topic-only channel points at a topic that can never receive messages, so we now leave such syntax as plain text rather than linkifying it. This is safe because validate_topics_policy refuses to set empty_topic_only while the channel has messages in named topics, so these channels can never contain a valid non-empty topic. To do this, the stream-topic handlers check the channel's effective topics_policy. The mention backend already caches a ChannelInfo for each linked channel, so it now also records the channel's topics_policy there. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

  • Shubham Padia(30 Jun 26)

    composebox_typeahead: Show empty-topic completion only on ">". An empty-topic-only channel can never contain a non-empty topic, so a link to a named topic in one is dead: clicking it narrows to a phantom topic in the left sidebar while the compose box falls back to the empty ("general chat") topic. Such channels therefore never offer named-topic completion. Selecting one inserts the complete channel link with no topic typeahead reopened by default; pressing ">" is the explicit request for a topic and inserts the partial `#**channel>` syntax, whose completion offers just the channel's single empty topic. Named-topic links can no longer be created for these channels, while the empty-topic link stays reachable. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Zulip Security

7.3/10

Repo Security Summary

Updated 24 Aug 26

  • Code-Review10/10
  • Maintained10/10
  • CII-Best-Practices0/10
  • Dangerous-Workflow10/10
  • PackagingN/A
  • Security-Policy10/10
  • Token-Permissions10/10
  • License10/10
  • Signed-Releases0/10
  • Binary-Artifacts10/10
  • Branch-Protection3/10
  • Fuzzing0/10
  • Pinned-Dependencies7/10
  • SAST10/10

Security Advisories (41)

  • mediumPatchedCVSS 6.5

    GHSA-42mq-rxcr-wj72Organization members could forge the sender of a group direct message

  • mediumPatchedCVSS 5.3

    GHSA-3x2r-gh27-7h4fUnauthenticated log injection via the CSP violation report endpoint

  • mediumPatchedCVSS 4.3

    GHSA-wj5v-8mqg-gvqwMissing access check in typing endpoint exposed inaccessible users' IDs and emails

  • mediumPatchedCVSS 5.3

    GHSA-3m37-hwq6-jrj8Custom profile fields can be read by logged-out visitors in organization with web-public channels

  • mediumPatchedCVSS 6.5

    GHSA-vwqp-7j32-xfg5Guests in organizations with restricted user visibility can gain access to profile information of other users

  • lowPatched

    CVE-2026-102893OpenID Connect authentication ignores the email_verified claim

  • mediumPatchedCVSS 6.5

    CVE-2026-97701Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

  • mediumPatchedCVSS 4.3

    GHSA-7w3h-65w5-m522Content of future message edits and topic metadata leaked to non-subscribers when moving messages to an inaccessible private channel

  • mediumPatchedCVSS 6.5

    CVE-2026-100404Guests can read new messages in non-subscribed public channels

  • mediumPatched

    CVE-2026-40300Message edit history visible in "moves only" policy through /api/v1/messages/{id}/history

  • mediumUnpatchedCVSS 6.1

    CVE-2026-26058Path Traversal in Import

  • highPatchedCVSS 7.1

    CVE-2026-25741Modification of Payment Method (Stripe Default Card) by Non-Billing Users

  • mediumUnpatchedCVSS 5.3

    CVE-2026-25742Anonymous File Access After Disabling Spectator Access

  • lowPatched

    CVE-2026-24050Stored XSS in user profile modal

  • mediumPatchedCVSS 6.8

    CVE-2025-52559XSS in digest preview URL

  • mediumPatched

    CVE-2025-47930Access control bypass for restrictions on creation of specific channel types

  • highPatchedCVSS 8.2

    CVE-2025-31478Authentication backend configuration bypass

  • lowPatchedCVSS 2.7

    CVE-2025-30368Organization exports can be deleted by administrators of a different organization

  • lowPatchedCVSS 2.7

    CVE-2025-30369Custom profile fields can be deleted by administrators of a different organization

  • mediumPatched

    CVE-2025-27149"Public data" administrative data exports can leak metadata for non-exported messages and client user agent strings

  • mediumPatchedCVSS 4.3

    CVE-2025-25195Events can leak private channel names

  • mediumPatched

    CVE-2024-56136/api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account

  • highPatched

    CVE-2024-27286Moving messages from public to private streams may leave them accessible

  • mediumPatchedCVSS 4.3

    CVE-2024-21630Non-admins can invite new users to streams they would not otherwise be able to add existing users to

  • mediumPatchedCVSS 4.3

    CVE-2023-47642Invalid metadata access for formerly subscribed streams.

  • highPatchedCVSS 8.2

    CVE-2023-33186Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

  • mediumPatchedCVSS 4.3

    CVE-2023-32677Users who can send invitations can add users to streams during invitation, even if they cannot add users to streams at other times

  • highPatchedCVSS 7.5

    CVE-2023-28623Unauthorized user can register an account in specific configurations involving LDAP and another external authentication backend

  • mediumPatchedCVSS 5.4

    CVE-2023-22735User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline`

  • mediumPatchedCVSS 6.5

    CVE-2023-32678Insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers

  • mediumPatchedCVSS 4.8

    CVE-2022-41914Non-constant-time SCIM token comparison in Zulip Server

  • mediumPatchedCVSS 4.3

    CVE-2022-36048IP address leak via image proxy bypass in Zulip Server

  • mediumPatchedCVSS 5.4

    CVE-2022-31168Insufficient authorization check for changing bot roles in Zulip Server

  • mediumPatchedCVSS 4.9

    CVE-2022-31134Public data export contains attachments that are non-public

  • lowPatchedCVSS 2

    CVE-2022-31017Zulip Server exposes edit events for old messages to new subscribers in protected-history streams

  • lowPatched

    CVE-2022-24751Race condition in user deactivation allows continued API access

  • mediumPatchedCVSS 4.6

    CVE-2022-23656Cross-site scripting vulnerability in Zulip Server development branch via tooltip

  • highPatchedCVSS 7.2

    CVE-2022-21706Multi-use invitations can grant access to other organizations

  • highPatchedCVSS 8.6

    CVE-2021-43799RabbitMQ exposes ports with weak default secrets

  • mediumPatched

    CVE-2021-43791Ineffective expiration validation for invitation links

  • mediumPatchedCVSS 4.3

    CVE-2021-41115Regular expression denial-of-service in linkifiers

Zulip Website

Website

Zulip — organized team chat

Zulip is an organized team chat app for distributed teams of all sizes.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address54.243.32.146
  • Hostnameec2-54-243-32-146.compute-1.amazonaws.com
  • LocationAshburn,Virginia,United States of America,NA
  • ISPAmazon Technologies Inc.
  • ASNAS16509

Associated Countries

  • USUS
  • CACA

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

zulip.com was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Zulip Android App

APK Info

De-Googled Compatibility

Native4.00/ 41 ratings
microG4.00/ 43 ratings
  • LineageOSmicroG4.0 / 4(2)

Tested on Android 15–16 · Updated 29 Oct 26 · View on Plexus →

Trackers

  • Sentry

Permissions

  • Access Network State
  • Access Wifi State
  • Internet
  • Read External Storage
  • Vibrate
  • Wake Lock
  • Write External Storage

Zulip iOS App

App Info

Zulip

Zulip (https://zulip.com/) helps teams of all sizes be more productive together, from a few friends hacking on a new idea, to globally distributed organizations with hundreds of people tackling the world's hardest problems. Unlike other chat apps, Zulip lets you read and respond to every message in context, no matter when it was sent. Maintain your focus and then catch up on your own time, reading the topics you care about, and skimming or skipping the rest. Like everything Zulip, this official Zulip mobile app is 100% open-source software: https://github.com/zulip/zulip-flutter . Thank you to the hundreds of contributors who have made Zulip what it is! Zulip is available as a managed cloud service or a self-hosted solution. Please send questions, comments, and bug reports to [email protected], or tweet @zulip.

Rating

Rated 3.69 out of 5 stars by 16 users

Version Info

  • Current Version30.0.274
  • Last Updated18 Aug 26
  • First Released18 May 17
  • Minimum iOS Version15.0
  • Device Models Supported127

App Details

  • IPA Size44.37 Mb
  • PriceFree (USD)
  • Age Advisory12+
  • Supported Languages1
  • DeveloperKandra Labs, Inc.
  • Bundle IDorg.zulip.Zulip

Screenshots

  • App screenshot
  • App screenshot
  • App screenshot

Zulip Reviews

More Team Collaboration

  • Privacy-focused messenger using the Matrix protocol. The Element client allows for group chat rooms, media sharing, voice and video group calls. End-to-end encryption by default for message content, but not metadata, which remains visible to the home server operator.

    Security Audited Open Source element-hq/element-web
  • Self-hostable Slack alternative with native desktop, mobile and web apps, and many integrations. There's no end-to-end encryption, so the server can read all messages, and telemetry is on by default. The open source edition caps at 250 users.

  • Easy-to-deploy, self-hosted Slack alternative with polished cross-platform apps. End-to-end encryption is supported, but off by default - without it, workspace admins can read all messages. Usage statistics are sent by default.

  • A decentralized, encrypted P2P friend-to-friend app for chat, forums, channels, boards, voice calls and anonymous file sharing. Best for trusted contacts, as it isn't anonymous unless you route it through Tor (off by default).

About the Data: Zulip

Change History

Edit Zulip Data

You can edit Zulip's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

API

You can access Zulip's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/zulip

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Zulip

Help your friends compare Team Collaboration, and pick privacy-respecting software and services.
Share Zulip and Awesome Privacy with your network!