Email engineering@prodready.online with the URL, the steps to reproduce, and the impact. Give us a reasonable window to fix it before any public write-up. Do not access other people's data, and do not run denial-of-service tests.
We acknowledge reports within four business hours on business days. We will not ask you to send exploit payloads that include live customer data.