Responsible Disclosure Policy

Effective date: July 10, 2026

LeonAI LTD ("LeonAI," "we," "us") welcomes reports from security researchers. The security of the LeonAI Links service — and of the millions of redirects it performs — benefits from the community's scrutiny, and we commit to working with researchers in good faith.

1. Scope

In scope:

• The redirect service at short.leonai.io (short-link resolution, interstitial warning pages, QR resolution)
• The dashboard at links.leonai.io and the marketing site at leonai.io
• The REST API at api.short.leonai.io (/api/v1)
• Official LeonAI SDKs (TypeScript, Python, Go)

Out of scope:

• Third-party services and subprocessors (Cloudflare, Sumit, Resend, Sentry, Google Safe Browsing) — report issues in those platforms to their own programs
• Customer-owned custom domains and the content of Destination URLs
• Social engineering of LeonAI staff or customers, and physical attacks
• Denial-of-service, volumetric, or resource-exhaustion testing of any kind
• Spam or abuse of the link-creation form itself (report abusive links under the Acceptable Use Policy instead)
• Automated scanning at volumes that degrade the Service
• Clickjacking on pages with no sensitive actions; missing best-practice headers, SPF/DMARC records, or cookie flags without a demonstrated exploit
• Reports that a short link "redirects to an arbitrary/malicious site": the Service is by design an open redirector for its customers. A redirect to a bad destination is an abuse report, not a vulnerability. However, a technique that bypasses our link scanning, disables interstitial warnings, or evades enforcement on a deactivated link is in scope and valued.

2. Qualifying Vulnerabilities

Examples of reports we want:

• Authentication or session-management bypass; privilege escalation between team roles
• Insecure direct object references (IDOR) exposing another account's or team's links, analytics, or settings
• SQL injection, stored/reflected XSS, SSRF, or remote code execution
• Short-code enumeration or timing techniques that disclose private link data (password-protected link bypass, expired-link resurrection)
• API-key scope escalation or authorization gaps between links:read, links:write, and analytics:read
• Webhook signature (HMAC SHA-256) forgery or verification bypass
• Link-scanner or interstitial-warning bypass techniques
• Exposure of secrets, credentials, or personal data

3. How to Report

Email care@leonai.io with the subject line "Security Vulnerability Report", including:

1. A description of the vulnerability and its security impact
2. Step-by-step reproduction instructions (requests, payloads, affected URLs/endpoints)
3. A proof of concept, limited to the minimum needed to demonstrate the issue
4. Your contact details and, if you wish to be credited, the name or handle to use

A PGP key for encrypted reports is available on request [PGP KEY TO BE PUBLISHED at leonai.io/.well-known/security.txt]. Please submit one issue per report and do not include personal data of other users.

4. Our Commitments

• Acknowledgment of your report within 2 business days
• Triage and severity assessment within 5 business days
• Remediation targets: critical — 7 days; high — 30 days; medium — 90 days; low — next scheduled release
• We will keep you informed of progress and notify you when the issue is fixed
• With your permission, we will credit you on our public acknowledgments page. That page is in preparation; until it is live we will confirm the credit to you by email and add it when the page is published

We do not currently operate a paid bug bounty. We may, at our discretion, offer swag, service credit, or monetary thanks for high-impact reports.

5. Ground Rules for Good-Faith Research

To qualify for the safe harbor in Section 6, you must:

1. Test only against accounts you own or test accounts you create; never access, modify, or delete another user's data — if you encounter it inadvertently, stop, do not save or share it beyond the minimum evidence needed, and report immediately
2. Not exfiltrate data beyond the minimum proof of concept
3. Not degrade, disrupt, or deny service to other users
4. Not use a finding to pivot further into systems, maintain persistence, or escalate beyond demonstrating impact
5. Give us a reasonable time to remediate before any public disclosure: coordinated disclosure after the fix ships or 90 days after your report, whichever comes first, with extensions negotiated in good faith for complex issues
6. Not demand payment as a condition of disclosure
7. Comply with all applicable laws

6. Safe Harbor

For security research conducted in good faith and in compliance with this policy, LeonAI:

• Authorizes your access to the in-scope systems for research purposes, and considers such research to be authorized conduct under the Computer Fraud and Abuse Act (CFAA) and analogous anti-hacking laws;
• Waives any claim under the DMCA § 1201 (anti-circumvention) and our Terms of Service restrictions to the extent they would otherwise prohibit your good-faith research;
• Will not initiate or support legal action against you, and if a third party brings action against you for policy-compliant research, we will make it known that your conduct was authorized.

This safe harbor applies only to systems we control: it cannot authorize testing of third-party services, and it does not bar claims by third parties. If you are unsure whether an activity is covered, ask us first at care@leonai.io.

7. Handling of Your Data

We use the information in your report solely to triage and remediate the issue and to contact and (with consent) credit you. Reporter identities are kept confidential unless disclosure is required by law or you consent.

8. Changes

We may update this policy from time to time; the version at links.leonai.io/legal/responsible-disclosure with the latest effective date governs research initiated after the change. Research already in progress under a prior version remains covered by that version's safe harbor.

Questions: care@leonai.io, subject "Security Policy Question."