Found a security problem? Please tell us.
We're grateful to anyone who reports a vulnerability to us privately, so we can fix it before it hurts anyone.
How to report
Write to [email protected]. Please don't open a public issue or post about it until we've had a chance to fix it.
It helps a lot if your message includes:
- what the problem is and where it is (a URL, an endpoint or a screen);
- the steps to see it for yourself;
- what someone could do with it;
- how we can reach you, if you'd like us to.
Our contact details are also in security.txt, where security tools look for them.
Please be kind to our customers
- Test only with your own account and your own data.
- If you come across anyone else's data, stop there, don't keep a copy, and tell us what you saw.
- Don't try to slow down or overload our services, and don't send spam.
- Don't try to trick our team or our customers into giving you access.
If you report something in good faith and stay within these lines, we'll treat you as a helper, not a threat.
What you can expect from us
- We'll let you know we've received your report, usually within a few working days.
- We'll tell you whether we could reproduce it, and keep you posted while we work on a fix.
- If you'd like, we'll thank you by name once it's fixed.
These are things we aim for rather than promises. We don't run a paid bug bounty at the moment.
Something else?
To see, export or delete the personal data we hold about you, write to [email protected]. The privacy policy explains what we keep and why.
For anything else, including help with your account, write to [email protected].