Coordinated Disclosure

Report Ethical Hacking

Security researchers and ethical hackers play a vital role in protecting our customers. If you have discovered a vulnerability in any of our properties, we want to hear from you.

Safe harbor

We will not pursue legal action against researchers who follow this policy in good faith.

Fast triage

Reports are reviewed by our security team within 3 business days.

Recognition

With your permission, we credit researchers in our public Hall of Fame.

In scope

✓ Authentication & session bugs
✓ Server-side injection (SQLi, RCE, SSRF)
✓ Cross-site scripting (XSS), CSRF
✓ Privilege escalation / IDOR
✓ Sensitive data exposure

Out of scope

✗ Denial-of-service / volumetric attacks
✗ Social engineering & phishing
✗ Physical security testing
✗ Reports from automated scanners
✗ Missing best-practice headers without impact

Please do not

Access, modify or destroy data that does not belong to you. Stop testing immediately if you believe you have accessed sensitive data and report it to us right away.

Submit a vulnerability report

Encrypted in transit. Please include enough detail for our team to reproduce the issue.

Your name *

Contact email *

Severity *

Affected asset / URL *

Vulnerability description *

Steps to reproduce

Include any proof-of-concept payloads, screenshots URLs, or relevant request/response snippets.

By submitting, you agree to coordinated disclosure.