We take the security of our systems and users seriously. If you believe you’ve discovered a security vulnerability, we encourage responsible disclosure.
Reporting a vulnerability
If you have identified a security issue, report it to [email protected]. Include as much detail as possible so we can understand and validate the issue:
- A clear description of the vulnerability
- Steps to reproduce the issue
- An assessment of the potential impact
- A proof of concept, if available
- Any suggested remediation (optional)
Scope
The following systems are in scope:
- The main production website and its subpages
- Official APIs and endpoints
- Authentication and account systems
Unless explicitly stated otherwise, these are out of scope:
- Third-party services or integrations
- Social engineering attacks
- Physical security or infrastructure
Response timeline
- Acknowledgement: within 48 to 72 hours
- Initial assessment: within 7 business days
- Status updates: as needed during the investigation
Safe harbor
We consider security research conducted in good faith and in line with this policy to be authorized activity. We will not pursue legal action against researchers who:
- Follow this policy
- Avoid privacy violations and data destruction
- Do not disrupt production services
- Report vulnerabilities promptly and responsibly
Guidelines
To keep disclosure responsible, please:
- Avoid accessing or modifying user data
- Do not perform denial-of-service testing
- Do not exploit a vulnerability beyond what is needed to demonstrate impact
- Do not publicly disclose the issue before it is resolved
Recognition
We appreciate the work of security researchers. With your permission, we may acknowledge your contribution publicly after a fix has been deployed.
Contact
Security team: [email protected]