What to send
- What you observed.
- The affected business, account, source, integration, phone number, or credential, if safe to share.
- The approximate date, time, and time zone.
- The affected page, endpoint, workflow, or integration.
- Screenshots, request IDs, timestamps, or log excerpts, if they do not expose another customer’s data or any secret.
- Your contact information for follow-up questions.
Do not
- Access, copy, modify, delete, export, or disclose data that does not belong to you.
- Attempt to bypass authentication, authorization, billing, carrier, compliance, rate-limit, or abuse-prevention controls.
- Run automated scans, probing, denial-of-service tests, stress tests, spam, credential stuffing, or password spraying.
- Test third-party systems, carriers, providers, customer integrations, customer websites, or customer lead sources without separate authorization from the owner.
- Social engineer, phish, or attack Leadping employees, customers, providers, vendors, or partners.
- Publicly disclose details before Leadping has investigated.

