Report a security issue privately

If you believe you found a vulnerability in Chaos Tourist, email support@chaostourist.com before discussing it publicly.

What to include

Send the affected page or feature, clear steps to reproduce the issue, what you observed, what you expected, and the potential impact. Screenshots are helpful when they do not expose private information.

Remove passwords, recovery codes, secret keys, session tokens, and unnecessary personal information before sending your report.

Protect people and the service

Do not access another person’s account or data, change or delete data, disrupt the service, or post vulnerability details in Community. Stop testing and contact us if you encounter private information.

Account safety

If you are concerned about your own account, change your password. If you cannot sign in, reset your password or contact support.

Machine-readable contact

Security tools can find the same reporting address in our security.txt file.