Security reports
Tell us if something looks wrong.
Use this path for vulnerabilities, broken access controls, or leaked credentials. Product bugs and billing go to Support.
What to send
- What you found, in plain language
- Where (URL, product name, or screen)
- Steps to reproduce if you have them
- Your contact email for follow-up
What never to send
- Seed phrases or recovery words
- Private keys or full payment card numbers
- Other people’s passwords or tokens
- Ransom or extortion language · we will not engage
If you believe a token already leaked, say so and stop using it. We will rotate on our side when we can verify the report.
Optional draft form
This builds a prefilled email. Nothing is stored on this page.
After you report
We acknowledge when we can, contain if access is at risk, and fix the control gap. We do not pay a public bug bounty from this page (if that changes, it will be written here first).