Report a security vulnerability

Send the report

Email [email protected] with the affected URL or component, reproduction steps, impact, and the minimum request or response details needed to show the issue. Do not include credentials, personal data or customer document content.

We aim to acknowledge a report within three business days and provide a substantive status update within ten business days. Remediation timing depends on severity and complexity.

Authorized research

Test only accounts and data you own or have written permission to use. Stop when you confirm a vulnerability, collect only the minimum evidence needed, and give us a reasonable opportunity to investigate before public disclosure.

Denial of service, social engineering, physical testing, automated high-volume scanning, persistence, lateral movement, and accessing or changing another party's data are not authorized.

Good-faith safe harbour

If you follow this policy, make a good-faith effort to avoid privacy violations and service disruption, and comply with applicable law, we will treat your research as authorized under this policy. We will not initiate legal action against you for that research. If a third party brings legal action related to it, we will make it known that your work complied with this policy.

Recognition and rewards

This is a vulnerability disclosure policy, not a bug bounty programme. We do not offer monetary rewards. We may acknowledge a researcher publicly when requested and when doing so is safe, lawful and mutually agreed.

For product controls and supplier information, read the trust centre.