Email security@diagrammo.app.

We will not pursue anyone who reports a genuine flaw in good faith and gives us a reasonable chance to fix it before going public. That promise is part of our Terms, and the same section asks you not to probe the hosted service for vulnerabilities without asking us first — so if you want to test something against Diagrammo Cloud, write to the same address before you start.

The same contact is published in machine-readable form at /.well-known/security.txt.