Security Policy

Reporting a vulnerability

Use the contact page with a clear description, reproduction steps, and potential impact. The production operator must configure a monitored security address before launch.

Please do

• Report what you find as soon as you can, with enough detail to reproduce it.
• Use a test account where possible, and only access data that belongs to you.
• Give us time to remediate before disclosing publicly.

Please don’t

• Run denial-of-service attacks or automated scanning that degrades the service for others.
• Access, modify, or delete data that isn’t yours.
• Use social engineering, phishing, or physical attacks against our staff or infrastructure.

Our commitment

We’ll acknowledge your report, keep you updated as we work on a fix, and credit you if you’d like. Good-faith research conducted within this policy will not lead to legal action from us.