Report a vulnerability

What helps

The URL or endpoint involved, and what you did. What you expected to happen and what happened instead. Whether it needs an authenticated session, and if so what kind of account. A proof of concept, if you have one.

Testing we are fine with

Testing against your own account. Reading our client-side source. Probing our public endpoints at a reasonable rate.

Testing we are not fine with

Accessing, modifying, or deleting data belonging to anyone but you.

Denial of service, load testing, or anything that degrades the service for other people. Our rate limits are there to keep the service up, not as a challenge.

Social engineering our team or our vendors.

Physical attempts against anything.

What we will do

Acknowledge your report, tell you whether we consider it a vulnerability and why, fix what needs fixing, and tell you when it is done.

We do not currently run a paid bounty programme. We will credit you when the fix ships if you would like to be credited, and we will not take legal action against good-faith research that stays inside the boundaries above.