Report a security or privacy concern
Stop the action, preserve minimum evidence, and use the approved channel without republishing sensitive data.
In this article
Stop sending, sharing, or the operation when that can still reduce exposure.
Do not copy sensitive data into a new chat, public comment, or unapproved ticket.
Note the surface, time, action, data type, and displayed message.
Preserve only the minimum authorized evidence and do not alter required logs or records.
Use the security, privacy, or support channel approved by your organization.
Follow the authorized owner’s instructions before deleting, correcting, or retransmitting anything.
Practical guidance
Describe what was exposed, on which surface and to which audience, using only the minimum necessary detail. Preserve the relevant time and action without copying secrets into the report. Removing an item from a view is not proof that every recipient, downloaded copy or linked resource has been addressed.
Advanced tips
Separate observed facts from assumptions: for example, distinguish a visible wrong recipient from a confirmed transmission. Follow the authorized incident owner’s instructions for containment and evidence retention rather than experimenting with additional sharing or deletion.