How to report an issue
Use the contact page and choose Cybersecurity. In the first message, include the affected URL, a concise description and enough non-sensitive detail to understand the issue. Do not include passwords, authentication tokens, private keys or unrelated personal information.
Testing boundaries
Please do not perform destructive testing, denial-of-service activity, social engineering, credential attacks, data exfiltration or testing against third-party services that are outside this website's control. If reproducing an issue could affect real users or data, stop and report the concern first.
What this page does not promise
This page does not establish a bug-bounty program, payment commitment, response-time guarantee or safe-harbor agreement. It provides a clear private reporting route and basic expectations for responsible handling.
Machine-readable policy
The website also publishes /.well-known/security.txt with the canonical reporting and policy links.
