Report a security issue
Send a security report to Sydnee through HackerOne and learn what to include.
If you find a security flaw in Sydnee, please let us know through our HackerOne form. A security flaw could let someone see private data, gain access to an account, or change work without permission.
Report a security issue on HackerOne
For help using Sydnee, routine bugs, or product feedback, open Help & Support.
Before you send a report
Use your own test accounts and sample data. Keep passwords, sign-in codes, session tokens, API keys, and client data out of your report. Remove them from screenshots and files before you attach them.
If you come across someone else's data, stop testing. Tell us what happened without copying or downloading their data. Keep testing safe for other users and the service.
The HackerOne form links to the program's scope, safe harbor, and disclosure rules. Read those rules before testing. Third-party services may have their own rules.
What should you include?
- Give the issue a clear title.
- Name the page, feature, or endpoint where you found it.
- List the steps needed to repeat the issue with your own test accounts.
- Explain what you expected and what happened instead.
- Describe the security impact and add only the redacted proof needed to show it.
You can send a report without a HackerOne account. Add your email if you want updates, or leave it blank to stay anonymous. Anonymous reports cannot be claimed later.
What happens next?
Your report goes to Sydnee's HackerOne inbox for review. We aim to reply within 3 business days and assess the issue within 7 business days. The form shows the current response targets. Fix time depends on the issue and its impact.