Responsible disclosure
Report a security issue in our own public systems in good faith.
[Pending: Live monitored contact address/URI and security.txt – TBD-019]
Please do not test against client systems, only against our own public assets, and do not access data beyond what is needed to demonstrate the issue.