Security contact

Report suspected vulnerabilities to security@shadowaccountant.com. Do not include customer records, live credentials, or exploit proof that would put other users at risk.

What to include

• A short description of the issue
• The affected URL or API path
• Steps to reproduce without accessing another user’s data
• Your contact email

You can also send a security note through the contact form using the Security category. We aim to acknowledge reports within two business days.

Workspace files use private storage and signed downloads. Row-level security is intended to keep each user to their own records.