Report a vulnerability
Email [email protected] with the affected host or endpoint, impact, reproduction steps, and a safe proof of concept. Do not include secrets in ordinary email.
Safe-harbor expectations
Use test accounts and minimal data. Do not degrade availability, access unrelated records, persist access, contact customers, or publish before we have had a reasonable opportunity to investigate and remediate.
What we will do
We will acknowledge a reproducible report, assign severity, preserve evidence, contain material exposure, and coordinate remediation and disclosure. A dedicated security address and public key will replace this launch channel before an enterprise SLA is offered.
Operational controls
Production configuration fails closed when core identity, billing, webhook, payment, or service credentials are missing. Public data responses are restricted to approved public evidence tiers; person-level enrichment is excluded from the shared public graph.