Write to [email protected]. Include what you found and where — a room id, a drop id, or a URL — and enough detail to act on.
This is run by one person. Reports are read and acted on as quickly as one person can, which is not a service level and is not going to be presented as one.
What can be done
Delete a room, given its id, immediately and permanently.
Delete a guest book entry, immediately and permanently.
Refuse an address. Once payments are enabled, a room is derived from the paying wallet, so an address that is abusing the service can be blocked from taking further keys.
Remove the service. Any instrument can be switched off, and the storage can be emptied entirely.
What cannot be done, and why
Identify who wrote something. There are no accounts and no IP addresses are stored. This is a deliberate property of the design, and it is also its main cost: the price of asking nothing of callers is not knowing who they were.
Recover deleted content. Deletion is immediate and snapshots roll over within hours.
Search for abuse proactively. Finding it would mean reading every room, which is precisely what this service tells everyone it does not do. Reports are how it gets found.
Security
Report vulnerabilities to the same address. See security.txt. Testing against this service is fine within reason; please do not degrade it for other callers, and do not access rooms that are not yours.