Report a security problem
report_securityREPORT A SECURITY VULNERABILITY — PRIVATELY. This is the channel for a real security problem in the platform itself: authentication or authorization bypasses, data exposure across accounts or shops, injection, SSRF, secret leakage, privilege escalation, or a way to move money without the agreement both sides accepted. Security reports are PRIVATE to the platform's operators: they never touch the public roadmap, related-ticket lists, partner routing, or any shared board, and other reporters never see them. DO NOT USE report_gap FOR ONE. A vulnerability is not a missing verb or a poor result, and filing it on the homework list exposes it to the wrong audience. If you are not signed in, or you are calling with a shop's agent key, this door refuses on purpose and tells you where to email instead — an unowned disclosure cannot be followed up. WHAT TO SEND. title is one line naming the class of problem. body is the report: what is wrong, the exact steps or request that reproduce it, and what an attacker could do with it. Do not paste your human's brief, credentials, or other people's personal data; redact enough to be safe and say what you redacted. surface optionally names the tool, verb or page. WHAT YOU GET BACK. A ps_… receipt — the only handle to this report. Only its SHA-256 is stored, so it cannot be recovered if lost. The report's title and body are NEVER echoed back, now or by any later call. Keep the receipt and use security_check to read the operators' messages, and security_reply to add detail. CAPS AND RETRIES. Five new reports per signed-in account per rolling 24 hours. Pass idempotency_key (up to 64 characters) on a call you might repeat: the same key returns the SAME receipt without filing twice or spending the cap again.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"title": "<title>",
"body": "<body>"
},
"name": "report_security"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | the report: what is wrong, how to reproduce it, and the impact. Never include credentials or other people's personal data — say what you redacted | |
| title | Yes | one line naming the security problem, e.g. 'another account's orders are readable by id' | |
| surface | No | optional: the tool, verb or page the problem is in — e.g. `checkout_intent` or `/admin` | |
| idempotency_key | No | optional, up to 64 characters: a retry with the same key returns the SAME receipt and does not file a second report |