Responsible disclosure
Report the affected area, impact, reproduction steps, and safe proof of concept where possible. Do not include secrets, credentials, or sensitive candidate data in the first message. Security reports should identify whether the issue affects the public site, authentication, recruiter workspace, candidate portal, interview flow, evidence packet access, or operational email delivery.