7 August 2026
Every app here is served from a name under erawan.app. A page built to deceive therefore borrows the reputation of the domain every other customer is on, which is why we would rather hear about it quickly than politely.
hello@erawan.app — read by a person, not a queue. Reports about phishing, malware or an attack in progress are looked at the same day.
You do not need an account here to report something, and you do not have to be the person being targeted.
Anything actively deceiving people — a phishing page, malware, an attack under way — comes offline first and gets explained afterwards. Everything else we look at, tell the account holder about, and give them a chance to fix before we act.
The rules an app has to keep are in the Terms; this page is only about telling us when one is broken.
A security problem in Erawan itself — the console, the API, the way apps are isolated — goes to the same address. Say so in the subject and we will treat it as a security report rather than an abuse report.