Reporting a problem
Send it through the contact route. If you believe you have found something serious, say so in the first line and do not include working credentials in the message.
What we do
Server credentials stay on the server and are never sent to a browser -- a check in the release pipeline fails the build if one appears in client code. Administrative actions are recorded in an audit trail. Sign-in passwords are checked against known breached-password lists at signup and reset.
What we do not claim
No certification, no audit, and no guarantee that the service is unbreakable. Anyone telling you a product this size has been penetration-tested to a standard should be asked which standard.
Your side of it
Use a password you do not use elsewhere, keep your workspace membership list current, and remove people who have left.
If something happens
If customer data is exposed we will tell the affected accounts what we know, what we do not yet know, and what we are doing, rather than waiting until the picture is complete.