Responsible Disclosure

How to report

Contact us with a clear description of the issue, the steps to reproduce it, the affected URL or endpoint, and its potential impact. Please give us a reasonable period to investigate before disclosing publicly.

What we ask

• Test only against your own accounts and data.
• Do not access, modify, or retain another member's information.
• Do not run denial-of-service, spam, or social-engineering tests against members or staff.
• Stop as soon as you have confirmed the issue, and tell us instead of exploring further.

What you can expect

• We aim to acknowledge reports promptly and to keep you informed of progress.
• We aim to fix confirmed issues on a timeline proportionate to their severity.
• We will credit you if you would like, once the issue is resolved.

Rewards

We do not currently operate a paid bug bounty programme. We appreciate reports regardless, and we may offer recognition.

Safe harbour

If you make a good-faith effort to follow this policy, we do not intend to pursue legal action against you for your research. This statement of intent is not legal advice and cannot bind third parties such as our hosting providers.

Send a security report→