Security and vulnerability disclosure
We want to hear about security problems in PingLoom. Reporting one in good faith helps every team that relies on us for alerts.
How to report
Tell us what you found, the steps to reproduce it, and how to reach you. Please do not include real customer data. Our machine-readable contact is at /.well-known/security.txt.
What we ask
- Give us a reasonable time to fix the problem before you share it publicly.
- Use only accounts you own. Do not access, change or delete other people's data.
- No denial-of-service tests, spam, or social engineering of our staff or customers.
- Test against a local or staging setup where you can, not the production service.
What you can expect from us
We will acknowledge a report, keep you informed while we investigate, and not take legal action against research that follows these rules. We do not run a paid bounty programme yet.
If you are a customer
You can sign out all sessions and revoke every API key in a project from the dashboard. If an API key leaks, revoke it first. See the contact page for support.