Responsible disclosure.
If you've found a security issue, we want to hear about it directly.
How we handle a report
We acknowledge receipt.
You'll get a human reply confirming we have your report and who is looking at it.
We investigate and keep you posted.
We'll tell you what we found, whether we're treating it as an issue, and roughly what happens next. If we disagree with your assessment we'll explain why rather than going quiet.
We fix it and tell you when it's done.
You'll hear from us when the fix ships. If you'd like credit for the report, say so and we'll ask you how you want to be named.
We won't pursue you for reporting in good faith.
Research conducted under this policy, in good faith and without harming anyone's data, is something we welcome rather than something we treat as an attack.
What we ask
- Report what you find to the address below rather than disclosing it publicly first.
- Give us a reasonable window to fix the issue before you write it up.
- Don't access, modify, or keep anyone else's data — tell us the access is possible instead.
- Don't run automated scanning that degrades the service for other people.
- Don't use social engineering against our team or our partners.
Where to send it
Write to the security address below. It is monitored. If you'd prefer to make first contact without detail, send a short note and we'll reply with a way to share the specifics.