Safe initial report
Describe the affected URL, observed behavior, approximate time, and minimal reproduction steps. Do not include live credentials, other people’s data, destructive payloads, or a working exploit in the first message.
Research boundaries
Do not disrupt availability, automate high-volume traffic, access or modify data beyond your own, establish persistence, perform social engineering, or publish sensitive details before a safe resolution path is agreed.
What happens next
The submission is stored in the private review queue. We do not promise a response or remediation deadline that has not been operationally established. If more detail is needed, the team can establish an appropriate channel.