Report vulnerabilities to security@postcept.com. We aim to acknowledge within 48 hours and to keep you informed through remediation. Good-faith research against your own data is welcome. Please do not access other tenants' data or degrade the service. Full policy: https://postcept.com/security