Responsible disclosure
If you find a security weakness, please report it to us privately so we can fix it before anyone is harmed.
How to report
Email our contact address (not published yet) with the subject “Security report” (also listed in /.well-known/security.txt) with a description, steps to reproduce and the impact. Please don't include real reporter data.
Please do
- Test only with accounts and reports you created.
- Stop and tell us as soon as you see data that isn't yours.
- Give us reasonable time (90 days) to fix the issue before disclosing it.
Please don't
- Access, change or delete other people's data.
- Run denial-of-service, spam or social-engineering tests.
- Submit large numbers of fake reports.
Our commitment
We will acknowledge your report within five working days, keep you informed, and credit you if you wish. We will not pursue legal action against good-faith research that follows this policy.