Report a finding

The fastest path is email. Web-form submission is intentionally not provided here — a form on this surface would itself become attack surface, and we would rather you keep your finding behind your own outbound mail security.

What to include in the email:

• Surface affected (e.g. chat.cloakapi.io, app.cloakapi.io/auth, SDK packages/secrets-detector@0.x.y).
• Reproduction steps — minimal proof-of-concept that demonstrates impact without exfiltrating live data.
• Impact assessment from your perspective (CVSS optional but appreciated).
• Whether you want public credit on /hall-of-fame and what handle to use.
• Your preferred follow-up channel and time-zone.

We acknowledge within one business day. Back to front page.