We consider the security of our systems a top priority. However, no matter how much effort we put into safeguarding our systems, vulnerabilities may still exist.
If you discover a vulnerability, we would appreciate being informed so that we can take action to address it as quickly as possible. We kindly ask for your help in protecting our customers and our systems.
Please do the following:
Do not exploit the vulnerability or issue you have discovered—for example, by downloading more data than necessary to demonstrate the vulnerability or by deleting or modifying other people’s data.
Do not disclose the issue to others until it has been resolved.
Do not carry out attacks involving physical security, social engineering, distributed denial-of-service, spam, or third-party applications.
Provide sufficient information to reproduce the issue so that we can resolve it as quickly as possible. In most cases, the IP address or URL of the affected system and a description of the vulnerability will be sufficient, but more detailed explanations may be required for complex issues.
Our commitments to you:
We will respond to your report within three business days with an evaluation of your submission and an expected timeline for a resolution.
If you have followed the instructions above, we will not pursue any legal actions related to your report.
We will treat your report with strict confidentiality and will not share your personal information with third parties without your consent.
We will keep you informed about our progress in resolving the issue.
As a token of appreciation, we will mention your name (if desired) on our Responsible Disclosure page. In some cases, we may offer a small gesture of thanks for vulnerability reports that are novel, relevant, and reproducible. Please note that we do not operate a formal reward program.
We strive to resolve all issues as quickly as possible, and we are happy to play an active role in any final publication about the issue once it has been fully resolved.