Security and Vulnerability Reporting
Report a technical risk without exposing other people or disrupting the service.
If your account may be compromised
Secure the sign-in provider using its official controls and stop DOS sharing where possible. Do not give a person claiming to be support your password, login code or recovery token. Contact DOS with the issue, approximate time and a safe reply address. Do not include the compromised secret itself.
Report a suspected vulnerability
Use the Contact route with the bug topic and prefix “Security”. Describe the affected feature, a minimal reproduction using your own account, the expected and observed behavior, and potential impact. Remove tokens, credentials and unrelated personal data from examples.
If you encounter another person’s information, stop accessing it and report the minimal facts needed to locate the issue. Do not enumerate, download, alter or publish user records to prove scale. Do not run denial-of-service tests, phishing, credential attacks or destructive actions.
Research boundaries
This page is not unrestricted authorization to test production systems or third-party providers, and does not offer a bounty, immunity or a safe-harbor agreement. Obtain written scope before testing that could affect another person, availability or protected data. Good-faith reporting will be assessed on its facts; lawful reporting and protected rights remain available.
Assessment and disclosure
A report should be assessed, relevant evidence preserved proportionately, and a confirmed issue contained and corrected. The team may need a secure follow-up route. Do not rely on an automatic form response as confirmation that remediation has occurred.
If an incident affects personal data, DOS must assess the actual risk and meet applicable notification duties. A general security disclaimer does not replace that assessment. Public disclosure should avoid exposing affected people or usable credentials.