Security & Responsible Disclosure

Responsible disclosure. We welcome good-faith reports of security issues affecting our production services.

Please stay within publicly accessible, non-destructive testing. Do not access, modify, or delete other customers' data, and do not interact with protected or authenticated functionality.

Report to [email protected] and include the affected URL, a description of the concern, its potential impact, and the steps to reproduce it. We aim to acknowledge your report within 5 business days.

We will not pursue good-faith researchers who follow this policy.

We do not operate a paid bug bounty programme and cannot offer rewards or fees. We are glad to review any genuine concern and to publicly credit responsible researchers who wish to be named.