PEOPLE / QUESTIONS / NEXT STEPS
Workspace questions, product issues, privacy requests and security reports each have a defined path.
Use the channel that matches the issue. Never send source code, credentials, private keys, access tokens, or customer data through a public report.
A conceptual map of the review workflow.
New to CodLab? Follow the getting-started guide to connect repositories and understand review results.
The authenticated CodLab dashboard shows connected repositories, review delivery state, retry activity, failed jobs, completed evidence, and active operational alerts.
Use the hello@codlab.app support inbox for a public product defect that contains no private repository names, source, diffs, credentials, personal data, or security exploit details. Include the affected public URL, approximate time, expected result, and observed result.
Customers and independent researchers can start a private report at hello@codlab.app with the subject “CodLab security report”. Start with the affected public URL, approximate time, and a brief description of the impact. Request instructions before sending sensitive reproduction material; never send credentials or customer source. Do not open a public issue for a suspected vulnerability.
Customers can also use the private security contact in their executed agreement. This shared business inbox does not establish an on-call service or a response-time guarantee.
Requests to access, correct, delete, restrict, object, port, or withdraw should be sent to privacy@codlab.app. Do not include account credentials or source code.
For a production-impacting incident, use the named operational contact in the executed agreement and include the review evidence ID, approximate time, and visible status. Response targets, service levels, and escalation duties apply only when stated in that agreement.