Email security@serverpod.dev. Please do not report security issues on the Bugs & improvements board, in GitHub issues or in pull requests: they are public.
Include:
- what an attacker could do (for example read other users' documents, take over an account, run code on the server, or get around sharing permissions);
- the steps to reproduce it, with the app (Drive, Write, Sheets, Slides) and the browser;
- whether you tested against wonky.work or a local copy.
We acknowledge reports within a few working days and keep you informed while we fix the issue. Please give us reasonable time to release a fix before you disclose anything publicly.
Wonky Work's server (wonky_server), the four web apps, the MCP endpoint (/mcp) and the
GitHub automation of this repository. Reports about third-party services (Serverpod Cloud,
Google sign-in, AI providers) are best sent to those projects directly; tell us too if Wonky
Work's use of them is affected.