Report a Security Issue
If you found a security vulnerability in Traffic Creator, for example in the dashboard, the Account API, the MCP server or the sign-in for connected apps, please tell us privately first.
How to Report#
E-mail [email protected] with the subject SECURITY and include:
- what you found and where (URL, API route or MCP tool),
- the steps to reproduce it,
- what an attacker could do with it,
- the time (UTC) of your tests and the account you used.
Please don't put details in a public ticket, review, forum or social media post. Our contact details are also published at traffic-creator.com/.well-known/security.txt.
Rules for Testing#
- Only test with your own account and your own campaigns.
- Don't access, change or delete other customers' data. If you see any by accident, stop, don't keep a copy, and tell us.
- Don't run load tests or anything that slows the service down for others.
- Don't try phishing, social engineering or physical access.
- Give us reasonable time to fix the issue before you tell anyone else.
What Happens Next#
Reports go straight to our team.
Not a Security Issue?#
For a lost password, a suspicious login or a key you think has leaked, see Keep your account secure and Create, use and revoke API keys.