Support
Support runs through one form, with the subject chosen up front so the message is routed by what it actually is. No account, and nothing to sign up for first. Security reports take the same route and are read before anything else.
01 / Channels
Three subjects, and the third is not interchangeable with the other two — a vulnerability should not be filed in public.
A share that would not open, a setting that did not hold, a page that broke. Include what you set, what you expected, and what happened instead — never the secret itself, and never the link.
Send a bug report BugsHow something works, whether a use case fits, or what a setting really means. Check the FAQ first — most answers are already written down there.
Ask a question QuestionsSecurity reports get a different route from ordinary bugs: they are read first, and they are never handled in public. The security page carries the threat model and what is considered in scope.
Disclose privately Disclosure02 / Check first
Worth a minute before writing anything up — each of these is working as designed, and each one looks like a bug.
Check whether it expired or ran out of views. Both are final and neither can be reversed, by you or by us. Check too that the whole URL survived the trip — some clients truncate at the #, and everything after it is the decryption key.
A share restricted to named recipients or to a domain requires the reader to sign in, so there is an identity to check the list against. Remove the restriction if that is not what you wanted.
ExpectedRegion and IP checks fail closed. When the source information is missing or cannot be trusted, the request is denied rather than allowed through — including behind some VPNs and corporate proxies.
Expected