Report a vulnerability

We run a private bug-bounty program. Please give us 90 days before public disclosure. Do not test against real user data or attempt account takeover of accounts you don't own.