Security and responsible disclosure

DRAFT: pending legal review. Use with care; final terms will be published before payments launch.

Reporting a vulnerability

Email our support inbox or use the support form with “Security” in the subject. Include the steps to reproduce, what an attacker could do, and how to reach you.

Scope

This website and its API. Out of scope: our providers’ own services, denial of service, social engineering, physical attacks, and reports from automated scanners without a demonstrated impact.

Safe harbour

If you act in good faith, stay in scope, use only accounts you own, access no more data than you need to show the problem, and give us reasonable time to fix it before telling anyone else, we will not pursue or support legal action against you.

What happens next

We acknowledge your report within 3 working days.
We confirm whether it is valid and how severe, within 10 working days.
We aim to fix critical issues within 7 days, high within 30 and the rest within 90, and tell you when it is fixed.