Responsible disclosure

Report a vulnerability

Email us directly with what you found. Include enough detail to reproduce it — steps, the affected URL or endpoint, and the impact.

We respond to reports within one business day, the same standard we hold for every direct inquiry.

Scope

Testing guidelines

Don't degrade the service for other users, access or modify data that isn't yours, or attempt social engineering against our team. If you're unsure whether something is in scope, ask first.

Encrypted reports

We don't currently publish a PGP key. If encryption matters for your report, say so when you write in and we'll agree on a secure channel.

Safe harbor

We don't yet have formal legal safe-harbor terms for good-faith security research — stated plainly rather than implied. Testing within the scope and guidelines above, and reporting promptly and privately, is exactly the kind of report we want to receive.