Security

Effective 27 September 2026

Responsible disclosure

Please provide enough detail for us to understand and reproduce the issue, while avoiding unnecessary access to personal information or disruption to users. Do not publicly disclose an unresolved vulnerability before MDPC has had a reasonable opportunity to investigate and address it.

Good-faith testing

Do not perform denial-of-service testing, destructive actions, social engineering, credential attacks, automated high-volume scanning, data extraction or tests that access another user’s information without permission.

What to include

Include the affected URL or service, a clear description of the issue, steps to reproduce it, the impact you observed and a safe way to contact you.

Security.txt

Machine-readable security contact information is published at /.well-known/security.txt.