What to report
Security-sensitive issues
Use the security inbox for issues that could expose someone else's data, break account boundaries, or create suspicious paid access. Before release, delivery proof must show this inbox is reachable and monitored.
Account mix-up or cross-user access concernsUnexpected public or shared URLsSensitive data leakage in logs, screenshots, or diagnosticsSubscription abuse, impersonation, or suspicious account behavior
Reporting guidelines
What helps a private review move quickly
Keep the report private. Share the smallest safe reproduction. Do not send secrets or private data from other people.
Do not include passwords, Apple login codes, or payment card data.Share the smallest reproduction that still shows the issue.If you believe user data is exposed, email security first instead of posting publicly.Include screenshots only if they do not reveal other people's private data.