Report a vulnerability

Found a hole in something we built, or traffic from our network that should not be there? Send it over.

The host, domain or address the issue is on.
Date and time with the timezone, if you have it.
What the issue is, what it gets an attacker, and how to reproduce it. Steps we can follow beat a description, and raw log lines beat a screenshot of them.
Being exploited right now? Close this form and mail [email protected] with URGENT in the subject. That one wakes people up.
Our promise to researchers
Report in good faith and no lawyer will ever hear your name from us. You get a reply within 24 hours and a verdict within three working days. Credit in the changelog if you want it, silence if you prefer that.
Out of scope
Missing headers with nothing behind them, rate limits on pages that do not need one, and scanner output pasted straight in. Same for anything that needs the victim's unlocked laptop to work.