Accounts and access
Separate sign-in, membership, permission and access to a source account.
Security questions
Ask precise security questions.
Understand the boundaries around accounts, records and connected services.
Records and sharing
Review who owns a record and who can access its evidence.
Report a concern
Prepare a private report. Keep credentials and sensitive records out of the initial message.
Keep the boundary clear
No security certification, penetration-test result, SLA or live control effectiveness is asserted here. Restricted information must be reviewed before it can be shared. Keep credentials and sensitive records out of an initial inquiry.