# Security — LeakWatch

> How to report a security issue in LeakWatch, and what's in scope.

Source: https://leakwatch.net/security

---

[← LeakWatch](/)

# Security

This is the page `/.well-known/security.txt` points to. Straight answers, no bug-bounty program to promise you.

## Reporting a vulnerability

If you've found a security issue in LeakWatch itself — the site, the API, the OAuth flow, anything that isn't a leak LeakWatch detected in someone else's repository — email me directly:

[security@leakwatch.net](mailto:security@leakwatch.net)

Include what you found, how to reproduce it, and what you think the impact is. I read this inbox myself — see [/about](/about) for who that is.

## Scope

In scope:

-   leakwatch.net and its API (api.leakwatch.net or /api/\*)
-   The OAuth / session flow, billing flow, and public report links (/r/:token)

Out of scope:

-   Secrets LeakWatch detected in third-party repositories — that's the product working as intended, not a vulnerability in it
-   Denial-of-service testing, automated scanners run against production without asking first
-   Social engineering, physical access, or anything targeting me rather than the Service

## What to expect

I'm one person running this alongside my studies, so there's no bug-bounty payout and no SLA I can legally commit to — but I do take reports seriously and act on them fast. In practice: acknowledgment within a few days, and a fix or mitigation shipped well before any public disclosure. If I go quiet longer than that, follow up — it means the email got lost, not that it was ignored.

## Responsible disclosure

Please give me a reasonable window to fix an issue before writing about it publicly. I'm not going to threaten anyone who reports in good faith — testing against your own account, without touching other users' data, is fine.