Get in touch

What we ask

• ·Report privately first and give us 90 days before publishing, or less by agreement if the fix ships sooner.
• ·Test only against your own account and your own API keys. Do not access, modify or retain another person’s data — if you stumble on some, stop, tell us, and delete it.
• ·No denial-of-service testing, no volumetric load testing, no spam or social engineering of our people or our providers, and nothing physical.
• ·Use the smallest proof of concept that demonstrates the issue. Do not run destructive operations, and do not exfiltrate more than the minimum needed to show it is real.
• ·Respect the third parties in the chain: our subprocessors have their own disclosure programmes, and issues in their platforms should go to them.

What we do

• ·Acknowledge within 3 business days, from a person, not an autoresponder.
• ·Give you a triage assessment — severity, and whether we agree — within 10 business days.
• ·Keep you updated while we fix it, and tell you when it has shipped.
• ·Notify affected users where the law or basic decency requires it, and a supervisory authority within 72 hours where a personal data breach requires that — the procedure is written down in the data processing addendum.

Things that are not vulnerabilities

To save you the time: missing security headers with no demonstrated impact, rate limits you consider too generous, the absence of a bug bounty, self-XSS, output from an automated scanner with no working proof of concept, and reports that the public data API serves public data.