Found a security problem? Report it here first.
A quiet fix beats a public surprise. Report in good faith and no legal action follows, whatever you found.
How to report
Email [security email]. Describe what you found, how to reproduce it, and how serious you think it is. You will get a confirmation within five working days, and serious issues are fixed within ten wherever possible.
What counts
The web app, the API, the socket server and this website. Anything that would let someone read or change files, get hold of a key, keep files past their expiry, or work out who sent or received something.
What doesn’t
Flooding the service with traffic, tricking a user or the operator into handing something over, reports straight out of an automated scanner with no working proof, and bugs in third-party services rather than in this software.