What to send
Describe the problem, the affected page, the steps needed to repeat it, and its possible impact. Screenshots are helpful when they do not contain private data.
Do not send passwords, sign-in links, card details, private access keys, or customer information.
Safe testing
Do not access another person's account or data. Do not damage data, interrupt the service, send large amounts of traffic, or use social engineering.
Stop testing after you have enough information to explain the problem.
Our response
We will review good-faith reports, ask for more information when needed, and work on confirmed problems based on their risk.
Send a protected security report.