Report a security problem

What to send

• What you found and where: the page, API route, or MCP tool.
• Steps to reproduce it, and what an attacker could do with it.
• How to reach you.

What we do

• Reply within 3 business days to say we have your report.
• Confirm the problem and how serious it is within 10 business days.
• Aim to fix critical and high problems within 30 days, and others within 90 days.

Testing rules

Test only against accounts and mailboxes you own. No denial of service, phishing, or sending mail to anyone but yourself. The full policy, including what is out of scope, is on the Security page and in security.txt.