Security

Prefer coordinated disclosure. Email findings (with repro steps and impact) to:

[email protected]

• Do not exploit beyond proof of concept on production tenants you do not own
• Do not access or modify other customers' data
• Allow a reasonable window for remediation before public disclosure

• Security headers (CSP, HSTS, frame denial, nosniff) on this site
• Certification Forge: signed verdicts, hash-chained evidence, public verify
• Default-blocked promotion until evaluation gates pass (fail-closed)
• Policy surface: Acceptable Use, Privacy, DPA

Suspected account takeover or billing fraud: contact [email protected] immediately and CC [email protected].