Data leaks and vulnerabilities

If a password or key is exposed

1. Revoke the compromised credential with its provider.
2. Create a new password or key and update the setting.
3. End suspicious sessions and check the user and role lists.
4. Review logs and recent changes.
5. If the secret was included in a mobile build, remove it from the configuration and prepare a new build.
6. Notify affected users if required by contract or law.

Deleting a message or file does not replace revoking the secret.

Report a vulnerability

Use the private support channel from your dashboard or contract. Include the affected URL or component, safe reproduction steps, expected and actual behavior, potential impact, test date, and app or browser version.

Do not attach a password, cookie, full FCM token, private key, card details, or another user's personal data. Remove such data from screenshots first.

Test the issue only on your own account, do not change other users' data, and stop after the minimum confirmation. For an active leak, authentication bypass, or changes to another user's payments, mark the request as critical and briefly describe the impact without including secrets in the subject.