Responsible disclosure

Email [email protected] with the steps to reproduce, the impact you think it has, and your contact details. Our /.well-known/security.txt has the same details and our PGP key.

We reply within 2 working days, keep you updated, credit you publicly if you’d like, and won’t take legal action against good-faith research that follows these rules.

Don’t access, change or delete other people’s data; use test accounts. Don’t run denial-of-service or spam tests. Give us 90 days to fix before publishing.