Report a suspected
security issue.
A clear report helps us understand the affected page or endpoint, reproduce the issue, and assess its impact.
View the published contact routeWhat to include
- The affected URL or endpoint and the time you observed the issue.
- A short explanation of the impact and the minimum steps needed to reproduce it.
- Redacted screenshots or request details, if useful. Remove passwords, access tokens, personal information, and other sensitive data.
- A way to contact you if you would like a follow-up.
Keep the report safe
Use only accounts and data you own. Stop if you encounter someone else's information, and describe what you observed without copying or sharing that information.
Avoid service disruption, bulk requests, destructive changes, social engineering, or attempts to access additional accounts. Third-party services and integrations have their own policies and are outside these guidelines.
These reporting guidelines are not a blanket authorisation to test systems or an assurance of legal protection. They do not establish a paid bug bounty programme.
What to expect
Reports need assessment before we can confirm a vulnerability or a resolution. We do not publish a guaranteed response time, dedicated staffing commitment, or fixed deadline for a fix.
If you believe a report involves active exposure of personal information, make that impact clear and avoid including the exposed data itself.