Getting spam to Cloudflare account email - cannot open ticket on the issue

Hello there,

I’m receiving spam to my unique Cloudflare email address. The waves started on 2020-11-16. I haven’t signed up for any Cloudflare newsletter (which might be leaking to a 3rd party) so I’m wondering if support could look into how you leaked the address before I change it.

That said I tried support but did not manage. How would I go about opening a ticket for this issue?

From my perspective this needs improvement.
I couldn’t find a meaningful way to reach Cloudflare on a topic of internal security.
While trying I found this to be a somewhat frustrating support experience.

Here’s the story (please feel free to correct me if I overlooked anything):

On the website no straight forward contact, no security portal - so you have to go to “Support” / or the “Help Center” or “Contact support”. All just leading you to support.cloudflare.com anyways. Which would be fine but you will find nothing related to security or core of Cloudflare business. I tried to follow the pipeline though so I chose “Cannot find…” > “Submit a request”.

It then leads to the next page, again not offering any help whatsoever. “Cloudflare status”, “ask the community” and other items mostly trying to funnel you back to the very portal you just came from.
From there the obvious choice would be to pick “get additional help”. And oh hello, we meet once again: “ask the community” or “search the help center” (guess what brought me here)!
I’m beginning to question anyone ever used / checked this workflow for sanity.

Then you’d click “get more help”, hoping you can just open a ticket, select “security” and go. But surprise. I now have to choose from my own domains!
" To get quick answers, select a Domain , describe your issue in the Summary box, and click Next to search the Cloudflare Support Help Center."
Hey there “help center”, haven’t we met before?

Of course Cloudflare.com isn’t even listed so in conclusion I cannot open a ticket about an issue with the security of Cloudflare.

Hi @user5818,

You do have to select a domain when opening a ticket from the dashboard, but you can select one of your own and just explain the issue.

Alternatively, you can email [email protected] from your account email address.

1 Like

There’s a well known standard to publish security contact details (“security.txt”), and that is by going to company.com/.well-known/security.txt.

I just checked, and Cloudflare has it too… https://www.cloudflare.com/.well-known/security.txt

If you believe they have an internal security issue, maybe it would be a good place to start…