Security Policy & Vulnerability Disclosure

Last updated: August 19, 2025

Introduction

The security of our users' data is our highest priority. We welcome and value contributions from the security research community to help us maintain a safe and secure platform. This policy outlines how to report vulnerabilities and what you can expect from us.

Safe Harbor

We consider security research and vulnerability disclosure activities conducted under this policy to be authorized and lawful. We will not pursue legal action against researchers who discover and report vulnerabilities in good faith and in accordance with this policy. We will work with you to understand and resolve the issue quickly.

Scope

This policy applies to the Linq.es service and its associated infrastructure.

• In Scope: *.linq.es
• Out of Scope:
  • Denial of Service (DoS or DDoS) attacks.
  • Spamming, social engineering, or phishing of our staff or users.
  • Physical attacks against our employees, offices, or data centers.
  • Third-party services we use (e.g., Google Cloud, Firebase, SendGrid). Please report vulnerabilities in those services directly to them.

How to Report a Vulnerability

If you believe you have found a security vulnerability, please send a report to [email protected]. We strongly encourage you to encrypt your message using our PGP key.

In your report, please include:

• A detailed description of the vulnerability and its potential impact.
• Clear, step-by-step instructions to reproduce the issue.
• Any proof-of-concept code, scripts, or screenshots.

Our Commitment

When you report a vulnerability in accordance with this policy, we commit to:

• Acknowledge receipt of your report within 2 business days.
• Provide an initial assessment and an estimated timeline for a fix.
• Keep you informed of our progress.
• Notify you when the vulnerability has been resolved.
• With your permission, publicly credit you for your discovery on our Hall of Fame.

Thank you for helping us keep Linq.es safe and secure.