Reporting a security problem

1. Open the contact page.
2. Under “What is this about?”, choose “A security report”.
3. Describe the problem: the page or address affected, what you did, what happened and what you expected.
4. Leave a way to reply if you want an answer. Without one, the report is read but cannot be answered.

The form is the only way to report a problem: this site publishes no email address.

• Do not put passwords, keys or other secrets in the report. Common kinds of passwords, keys and tokens are removed before the report is stored, but not every secret can be recognised.
• Test only in ways that do not harm the site or its visitors, and do not try to reach anyone else’s data.
• Send a report once. The form accepts a few messages a day from one network.

Only the site owner reads reports. A report is stored with the other messages from the contact form and deleted 180 days after it was sent, as the privacy page describes.

The same details, in a form other programs can read, are in the site’s security contact file.