Vulnerability Disclosure Program
We take security seriously and welcome responsible reports of potential vulnerabilities in our application, website, APIs, and related services.
Reporting a vulnerability
If you believe you have discovered a security vulnerability, please report it to us by email at:
Please include as much detail as possible, including:
- A description of the issue
- Steps to reproduce it
- The affected system, URL, endpoint, or Slack app feature
- The potential security impact
- Any safe proof-of-concept details
Responsible disclosure guidelines
When researching or reporting vulnerabilities, please:
- Do not access, modify, delete, or exfiltrate user data
- Do not disrupt service availability
- Do not perform social engineering, phishing, or physical attacks
- Do not publicly disclose the issue before we have investigated it
- Act in good faith and only test against accounts or data you control
Our commitment
We will make a good-faith effort to:
- Acknowledge valid reports within a reasonable timeframe
- Investigate reported issues promptly
- Keep reporters informed where appropriate
- Remediate confirmed vulnerabilities based on severity and risk
Safe harbor
We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, follow this policy, avoid harm to users or systems, and do not access or misuse data that does not belong to them.
Out of scope
The following are generally out of scope:
- Denial-of-service attacks
- Spam or social engineering attacks
- Reports from automated scanners without demonstrated impact
- Issues requiring physical access to a user device
- Vulnerabilities in third-party services outside our control
No bug bounty
We do not currently offer a paid bug bounty program. Reports are appreciated, but compensation is not guaranteed.