Responsible Disclosure Policy

Email [email protected] with a clear description, the steps to reproduce, and (if possible) a proof of concept. We aim to acknowledge reports within a few business days.

This is a responsible disclosure program, not a paid bug bounty — we do not currently offer monetary rewards. Reporters who follow this policy are credited in the Hall of Fame below, with their permission.

• Report the issue privately to [email protected] with enough detail to reproduce it.
• Give us a reasonable amount of time to investigate and fix the issue before any public disclosure.
• Only test against your own account and data. Never access, modify, or exfiltrate another user's data.
• Stop testing as soon as you have confirmed the vulnerability — do not pivot to explore how far it goes.

• No denial-of-service testing, spam, or automated mass-scanning against production.
• No social engineering of our staff, users, or support channels.
• No physical attacks against our offices or infrastructure providers.
• No public disclosure (blog post, social media, CVE) before we confirm the issue is fixed.

• Missing security headers or best-practice suggestions with no demonstrated impact.
• Reports generated purely by automated scanners without manual verification.
• Issues in third-party services we integrate with (report those to the provider directly).
• Rate-limit or CAPTCHA bypass without a demonstrated follow-on impact.

No reports have been publicly credited yet. Be the first — see “How to report” above.