1. Email [email protected] with details, reproduction steps, and any impact assessment.
  2. We confirm receipt within 2 business days.
  3. We triage, fix, and ship a patch — usually within 14 days for high-severity issues.
  4. We credit you in the changelog and on this page (with your permission).

Please do

  • Test on your own account.
  • Report immediately on discovery.
  • Give us reasonable time to fix before going public.

Please don't

  • Run automated scanners that generate excess load.
  • Access, modify, or delete data that isn't yours.
  • Test denial-of-service.
  • Exploit issues beyond what's necessary to confirm them.