Reporting a security vulnerability

Email [email protected] with a description of the issue, the steps to reproduce it, and its potential impact. Please include enough detail for us to reproduce and verify it — screenshots or a short proof-of-concept are helpful.

Machine-readable contact details are also published at /.well-known/security.txt per RFC 9116.

• Give us a reasonable time to respond before any public disclosure — we aim to acknowledge reports within a few business days.
• Don't access, modify, or delete data that isn't your own beyond what's strictly necessary to demonstrate the issue.
• Don't run denial-of-service testing or anything that could degrade the service for real users.
• Don't use social engineering against our team, contractors, or users.
• Test only against your own account where possible — this site hosts real customer data.

We won't pursue legal action against anyone who reports a vulnerability in good faith and follows the guidelines above, even if they technically violate our terms of service in the process of investigating or reporting it. We'll keep you updated as we investigate and fix confirmed issues, and we're happy to credit you publicly if you'd like.