Responsible disclosure

Security policy

Please report suspected vulnerabilities through the security contact published in our security.txt record. Do not post vulnerability details in public channels.

Email the security response team

What to include

Include the affected page or service, the steps that revealed the issue, its expected impact, and a safe way to contact you. Never send another person’s data, credentials, bulk records, or destructive proof.

Safe research boundaries

Do not degrade service, send bulk email, use social engineering, access more data than needed to confirm the issue, or retain data you encounter.

Response

We aim to acknowledge complete reports within two business days, then coordinate next steps according to risk. This is not a bug bounty or a waiver of legal rights.