Security & Responsible Disclosure

Email [email protected] with enough detail to reproduce the issue - the affected URL or component, the steps, and its impact. We aim to acknowledge reports within a few business days.

• Give us a reasonable chance to investigate and fix before disclosing publicly.
• Test only against your own accounts or data.
• Avoid privacy violations, data destruction, and service disruption.

• Access or modify data that isn't yours.
• Run denial-of-service tests or send spam.
• Use social engineering or physical attacks against our team or facilities.

Researchers who report valid issues in good faith help keep our guests and partners safe, and we're grateful. We're happy to credit you publicly once an issue is resolved - just let us know how you'd like to be named.