Responsible disclosure
Share security findings privately with our team. Please give us reasonable time to investigate and remediate an issue before public disclosure.
What to include
Include clear reproduction steps, affected components, impact assessment, test evidence, and any suggested mitigation. Never access, modify, or delete another person’s data.
Safe research
Do not run denial-of-service tests, social engineering, phishing, spam, physical attacks, or tests against third-party services. Use only accounts and data you own.
Rewards
Eligible, verified vulnerabilities may qualify for recognition or a reward at our discretion, based on severity, impact, report quality, and program rules in effect when the report is received. Rewards are not guaranteed.
Send a private report to our security team. Please do not include sensitive personal data in the initial message.