Security
Responsible disclosure
Report a technical vulnerability safely and give us an opportunity to investigate before public disclosure.
How to report
Email investiqco@gmail.com with the affected domain or app version, clear reproduction steps, expected impact and a safe contact route. Use harmless examples and minimise personal data.
Safe testing
- Test only accounts and data you own or are expressly authorised to use.
- Stop if you access someone else's data and report it without copying or sharing it.
- Do not use denial of service, physical access, social engineering, spam, malware or tests that disrupt others.
- Do not alter or delete data or attempt to retain access.
What to expect
We aim to acknowledge a useful report within five working days, provide an initial assessment within ten working days and update you at material stages. Complex cases may take longer. We ask for reasonable coordination before disclosure.
There is currently no bounty programme and this page does not promise payment. Good-faith testing that follows these rules is treated as security research, but this page cannot authorise breaking the law or a third party's rules.
Other reports
Report harassment, fraud or illegal user content through the content-reporting form. Do not put vulnerability details there.