Reviewed
Send a private report
Use the security category and the published security mailbox or security.txt contact. Describe the affected product page, the expected and actual behavior, and minimal reproduction steps using your own account.
Redact secrets and other people's information. Do not send passwords, session cookies, private reset links or raw provider responses.
Keep the investigation bounded
Stop once the issue is demonstrated. Do not access or retain another customer's data and do not test airline systems through this service. Read the disclosure policy on the Contact page before further testing.
A response-time target is only a target when published by the operator. This guide does not promise a bounty or a resolution deadline.