Report a concern without exposing user data.

Read the responsible-disclosure policy before testing or submitting. Use accounts and synthetic files you control.

Never include passwords, OTPs, cookies, access tokens, encryption keys, complete transfer URLs, personal information, or private file contents.