Protect your account
Two-factor authentication is available from Account → Security. Save the recovery codes offline and revoke sessions you no longer recognize. Never send a password, authenticator secret or recovery code in a support ticket.
Responsible disclosure
If you believe you found a vulnerability, report only what is needed to reproduce the issue and avoid accessing data that does not belong to you. Do not run destructive tests against production systems.
For a private report, open a support ticket and choose Security report. Keep the report limited to the information needed to reproduce the issue and do not include credentials or unrelated customer data.