Please wait 90 days before you publish the vulnerability or pass it on to other parties. This will give us enough time to investigate and fix the problem.

You need not fear prosecution if you report a security vulnerability. We will treat your information confidentially and ensure that your report is processed securely.

No additional obligations arise from the notification. You do not have to sign any NDAs or other agreements.