Security Policy

If you believe you have found a security vulnerability in our website, services, or open-source projects, report it to [email protected]. Include the affected asset, a description of the issue, and steps to reproduce it. For our open-source repositories, you may also use the private advisory feature on GitHub.

• We acknowledge valid reports within three business days.
• We provide an assessment and expected remediation timeline after triage.
• We keep you informed through resolution and credit reporters who wish to be named.

We will not pursue or support legal action against researchers who act in good faith, avoid privacy violations and service degradation, and give us reasonable time to remediate before public disclosure. Testing must stay within the scope described here and must not access or modify data that is not your own.

Denial-of-service testing, social engineering of our staff or customers, and physical attacks against our facilities are not authorized under this policy.

We follow coordinated disclosure. We ask that you keep vulnerability details private until we confirm a fix has been released, after which we are glad to publish an advisory together.