Include
What you found
A concise description of the issue and the affected page or service.
How to reproduce it
Steps, request details, or screenshots that make the behavior understandable without requiring unnecessary sensitive data.
Impact
What an attacker could plausibly access, change, or cause if the issue is valid.
Please avoid
Do not send passwords, private keys, production secrets, or unrelated personal data in the initial report. We do not currently run a bug bounty program. Good-faith research that meets the conditions in section 9 of our Terms of Use is authorized, and we won’t take legal action over it.