How to report a hole you found

One road in: the contact form on the support page. It works without signing in, because the person who cannot sign in must be able to write about that.

There is no separate security address and no security topic in the list. Pick Other, put the word security at the front of the subject, and the message lands in the owner's queue.

• No account needed

  A pass, if your browser holds one, ties the report to you. An expired pass does not get the message rejected.

• Eight messages in ten minutes

  That is the limit on the form, and rejected attempts count too, so a typo costs one of the eight.

• A number comes back

  The screen shows the request number after sending. Without it neither of us can point at the same message later.

Four things, and they are short on purpose. A promise we cannot keep is worse than a missing page.

The exception belongs here and not at the bottom. The owner's queue sorts paying customers first, so a report from someone who never bought anything waits behind them.

• A first answer within five working days

  Counted from the day the message lands. A person writes it, and it says what we make of the finding.

• No move against a good faith report

  No lawyer, no police, and no closed account for telling us something we did not want to hear.

• The fix is named in the changelog

  Entries there carry the day the work landed and what changed, and a fix from outside is written down as such.

• Your name in that entry, if you ask

  Say so in the message. Saying nothing means no name.

There is no money. Card payment is not connected to this product at all, so there is nothing to pay a finder from.

There is no legal shield beyond the paragraph above. The terms of sale do not exist yet: they need a named seller and a named country.

There is no repair date either. We will say what we intend to do and then name the day we did it.

The answer travels by letter to the address you typed into the form, through the same queue as every other letter the server sends.

When the mail route is not configured, the letter waits under a mark saying it has not gone, and the panel shows that mark rather than the word sent. Honest on our side, silence on yours, so give an address you read.

No screen shows you your earlier requests. The server can list them and nothing on the site asks it to, so the number from the form is all you hold.

Ours is what we wrote: the server, this site, the app on your machine and the browser engine we compile. A finding in any of those belongs here.

Not ours is what a site does once a profile opens it, what a proxy seller does with your traffic, and what the upstream browser project publishes.

A hole in somebody else's product is worth reporting to them. We can pass a message along, and that is the most we can do.

Some weak spots are written down on the changelog page under what is knowingly unfinished. A report about those will not be news.

• The Windows installer is not signed

  Windows warns on the first run, and the download page says so.

• The macOS images are not notarized

  The first launch needs Open Anyway in the system settings.

• The app does not fetch updates yet

  A check started by hand reports an error rather than an update.

• Card payment is not connected

  The checkout is written and stays inert without keys.

Send the steps, the build you ran and what you saw. A report written inside the app carries a description of that machine, with the secret fields cut out by name before it leaves your disk.

Hold back live passwords, cookies and keys. Your message is stored the way you typed it and a person reads it in a panel, so a secret there sits in the open.

Hold back other people's accounts too. A finding we cannot repeat without harming somebody who never agreed is one we will not act on.