What happens next
- We acknowledge your report within 5 business days.
- We triage it within 30 days, and update you at least every 30 days.
- We aim to fix confirmed critical issues within 90 days.
The rules
Give us reasonable time to fix an issue before you disclose it, never access or keep data that isn't yours, and don't degrade the service. We won't take legal action against good-faith research that follows these rules. There's no paid bug bounty, but we'll thank you and credit you publicly if you'd like.