Reporting
Email the security address on the contact page with a description, the steps to reproduce, and the impact you believe it has. Do not include customer data you may have seen; tell us that you saw it. We acknowledge within two business days.
What we ask
Test only against your own accounts, do not access or modify other people's data, do not degrade the service, and give us reasonable time to fix before disclosing. We will not pursue researchers who follow these rules in good faith.
What we do
We triage, confirm, fix and tell you when it is resolved. We credit reporters who wish to be credited once a fix is live.