Reporting a security problem

If you have found a security problem, please tell us before telling anybody else.

How to report one

Write to the address on the contact page with what you found and how to reproduce it. A reply comes within three working days, and it says whether the report is understood and what happens next.

What we ask

• Give us reasonable time to fix it before it is published.
• Do not access, change or delete anybody else's data.
• Do not degrade the service for other people while testing.

What we will not do

We will not pursue anybody who reports a problem in good faith under these terms.

What is in scope

The platform itself. Not the payment rails, the messaging gateways or the hosting underneath — those belong to their own operators, and a problem in one of them should go to them.