​
Where to go

Never send a security vulnerability to the general support address, and never include an API key, session cookie or registry credential in any message. If one has been exposed, rotate it first.

​
What to include

A request with these details can usually be answered without a follow-up question:
1

What you expected and what happened

One sentence each. Include the exact error message or HTTP status and response body.
2

Where it happened

The dashboard page or the API method and path, for example POST /api/v1/scans, and roughly when, with a timezone.
3

Your deployment

The version you run, and the output of GET /api/v1/system/status for your tenant. See Health and metrics.
4

Relevant logs

API and worker log lines around the time of the failure. Remove secrets before sending.

​
Before you write

The troubleshooting pages cover the failures that actually happen, and the FAQ answers the questions most often asked during an evaluation.