Report a security vulnerability

Before you write: the rules and our commitment not to pursue you are on a page of their own. In short: if you look in good faith and within those rules, you have nothing to fear from us.

A human will review your report within five working days. Where it indicates access to personal data or active exploitation, within 24 hours. You need no account, and no address.

Where exactly does the finding occur?

What does an attacker achieve?

Expected and actual behaviour, step by step.

Please redact other people's credentials first.

Optional. Without an address we cannot ask follow-up questions; your case number remains your proof.