Help
Inspect the control and its evidence.
Security claims should identify what is implemented, configured, deployed, and verified.
Use the official channel
Start from the exact company hostname and its official-channels record. Do not trust a similar-looking page, unsolicited installer, or payment link merely because it uses the brand.
Protect secrets
Never submit passwords, recovery codes, API keys, or full payment-card details in a public support message. Verify the reporting destination before sending private evidence.
Read the scope
A company website control does not automatically protect a separate product service. Look for the affected system, version, verification date, and important limitations.
Distinguish source and deployment
Source code can implement validation or headers while production still serves another version. Deployment and live verification are separate evidence stages.
Avoid unsupported assurance
An engineering review is not an independent audit, certification, or compliance authorization. Such claims require their own evidence.
Report responsibly
A useful security report explains the affected URL, observed behavior, reproduction steps, impact, and time. Avoid accessing another person’s data or disrupting service.