Report a vulnerability

How to write to us

Send an email with the subject “Security vulnerability”. Please do not open a public discussion and do not publish anything before we have been able to fix it.

What to tell us

A few lines are enough, as long as we can reproduce the problem.

• The address of the page or feature concerned.
• What you did, step by step, and what you observed.
• What you think this would let a malicious person do.
• If you wish, how we may credit you in our thanks.

What we ask of you

• Do not view, copy or change data that is not yours.
• Do not slow the site down on purpose and do not run large-scale tests.
• Do not try to deceive or trap people (phishing, for example).
• Give us a reasonable time to fix the problem before making it public.

What you can expect

We read every report and reply by email. We have no bounty programme: we can thank you by name, if you wish.