Talk to the people building Fillo.

Start with the documentation and troubleshooting guide. The Management API contract is published as OpenAPI 3.1, and coding-agent setup begins at llms.txt.

If the documented behavior and the service disagree, include the route, approximate time, response status, and request id when it is safe to do so. Never email passwords, API keys, OAuth tokens, signed upload URLs, or respondent answers.

Send security reports to hello@fillo.so with enough detail to reproduce the issue safely. Privacy and data-rights requests use the same monitored address; the Privacy Policy explains which party controls form responses. The Security page describes the current safeguards and the claims Fillo does not make.

If a public Fillo form is being used for phishing, spam, malware, harassment, or unlawful collection, use the abuse report. That flow keeps the form reference and supporting details together so the report can be investigated without mixing it into a general product question.