Security
Responsible disclosure
Found a vulnerability, exposed data path, auth bug, or anything else that smells wrong? Send it here and the admin inbox can pull it straight into the internal security reports queue.
What to include
Clear reproduction steps, affected URL or area, expected vs actual behavior, screenshots if helpful, and your best guess at impact.
Helpful details
Browser, device, account type, domain, timestamps, sample payloads, and whether the issue is repeatable or one-off chaos.
Please do not
Exfiltrate data, spam the mailbox, hammer production, or “prove” impact by wrecking something. That is not research. That is just being a problem.
Reporting guidance
- Email the security contact with a concise subject line.
- Describe the issue, impact, and exact steps to reproduce it.
- Include the affected domain, page, account state, and any relevant logs or screenshots.
- Give the team reasonable time to review and fix the issue before public disclosure.
DevelopersAccess routes security mailbox imports into the internal admin security workflow when the inbox module is enabled.