Reporting a Vulnerability

How to report

Email security@research-monitor.com with what you found, the steps to reproduce it, and what an attacker could do with it. Please don't include more of anyone's personal data than you need to show the problem.

Good-faith research

If you look for vulnerabilities in good faith, stay within the limits below, and report what you find to us privately, we will not bring legal action against you for that research. Use only your own accounts, stop as soon as you have shown a problem, and give us reasonable time to fix it before telling anyone else.

Please don't

• access, change or delete other people's data, or keep any you come across;
• degrade the service for others, for example with load or denial-of-service testing, or by running up AI usage;
• use social engineering, phishing or physical access;
• test our service providers' systems; report problems in them to the provider.

What happens next

We aim to acknowledge reports and to let you know when a problem you reported is fixed. We don't run a paid bug bounty, but we are glad to credit you if you would like. Our Privacy Policy and Terms cover everything else.