Vulnerability Disclosure Policy

Last updated: October 20, 2026

1. How to Report

Email [email protected] with the affected URL or service, the steps to reproduce, and the impact you observed. One report per issue helps us respond faster. Our machine-readable contact is published at /.well-known/security.txt.

2. What to Expect

We acknowledge every report within 3 business days and aim to share our assessment within 10 business days. We will tell you when the issue is fixed and, if you wish, credit you by name.

3. Testing Guidelines

Use only accounts you own, access no more data than you need to show the issue, and never modify or delete data. Do not run denial-of-service tests, social engineering, spam or physical attacks. Give us reasonable time to fix an issue before you disclose it publicly.

4. Rewards

We do not run a bug bounty program and do not pay for unsolicited reports. A report that comes with a demand for payment is handled as a security report only; we do not negotiate payment.