How do I report a security issue?
Updated 1 September 2026
The Short Answer
Report it through Account Settings then Feedback. Describe what you found and how to reproduce it. Please report it privately rather than publicly, and give it a reasonable window to be fixed before disclosing it anywhere.
Reports are welcome. Here is what makes one useful, and what is asked in return.
How do I report it?
Account Settings → Feedback.
Say clearly at the top that it is a security issue so it is not read as an ordinary bug.
What should I include?
3 things:
- What you found.
- The steps to reproduce it.
- What it lets someone do.
That third one is what decides how urgently it is treated.
What is asked of me?
Two things:
Report it privately rather than posting it publicly, and give a reasonable window for a fix before disclosing it anywhere.
That is standard responsible disclosure, and it protects the people using the product.
What should I not do?
Do not access anybody else's account, data or messages to demonstrate an issue.
Use your own account. A report describing what would be possible is just as useful and puts nobody at risk.
Will I hear back?
Yes. A security report is answered, unlike general feedback where a reply is not guaranteed.
It is worth including a way to reach you.