Company · Security
Reporting a vulnerability, and the site protections
Suspected vulnerabilities go to [email protected]. A report carries the affected URL, minimal reproduction steps and the expected impact, with personal data and credentials redacted.
Boundaries
Research boundaries for a test
Use your own test account. Leave other people's data, the services and the providers untouched. Stop and report an accidental exposure without copying it.
Protections
Protections the website runs
- Scripts
- a nonce per request
- Requests
- origin checks and request limits
- Product routes
- answer to approved accounts
- Fonts and media
- served from the site itself
- Certification
- none claimed
Response
How a report is handled
We assess reports and coordinate remediation. There is no paid bug bounty programme and no guaranteed response time.