How to report a security issue

If you think someone has got into your account without permission, or you've found something that could be a security flaw, let us know as soon as possible.

If you suspect unauthorized access

While you write to us, do this to cut off access:

Deactivate the affected user in Settings → Team, if you're the Owner.
Log out on the devices you can.
Protect that person's email: change the password and check two-step verification. Access to WorkOS depends on email.
Review the integrations in Settings → Integrations and disconnect any you don't recognize.
If the person used Kairos from Claude or ChatGPT, disconnect WorkOS in that app.

How to let us know

Write to us from the Contact and support page, linked in the footer of this page. Include:

What you saw and when.
Which account or user it affects.
Whether you've already done any of the steps above.

Don't include passwords or sign-in codes in the message.

If you've found a flaw

If you've detected a possible security flaw in WorkOS, tell us through the same channel, with the steps to reproduce it. Don't test it against other people's data or publish it before we've fixed it. We'll reply to confirm we've received it.