Developers
Vulnerability disclosure
Where a security report goes. The disclosure process is the authorised channel, and this page only points at it.
What you do here
Follow the disclosure page for the address, what to include and the safe-harbour terms it states. Do not file a vulnerability as a partner or developer enquiry.
What this does not grant
No bounty table is published. Good-faith research is not a partnership and not permission to test beyond the process.
Before you continue
Customers report defects in a system they operate through the support path their agreement names, if they have one.
Last reviewed 8 November 2026.