Security & responsible disclosure

How to report

Email us with enough detail to reproduce the issue — the affected URL or endpoint, the steps involved, and the impact you observed. Send reports to one of the addresses below; the same contacts are published in our security.txt.

Our commitments

• We acknowledge new reports within three business days.
• We keep you updated on our progress toward a fix and confirm when it ships.
• We will not pursue legal action for good-faith research that follows this policy.
• With your permission, we are happy to credit your discovery once the issue is resolved.

What we ask of researchers

• Act in good faith and avoid privacy violations, data destruction, or service disruption.
• Only test against accounts and data that belong to you.
• Give us a reasonable opportunity to remediate before disclosing publicly.
• Do not run volumetric denial-of-service tests or automated spam against the service.

Scope

The URL BOT service at https://urlbot.cc and its short-link redirects are in scope. Out of scope: third-party platforms we integrate with, reports of missing best practices without a demonstrated impact, social engineering, and volumetric denial-of-service.

How we protect URL BOT

A short, non-exhaustive summary of controls already running in production:

• HTTPS everywhere, served through a hardened edge with origin verification.
• Strict outbound email authentication with SPF, DKIM, and DMARC.
• Per-request Content-Security-Policy nonces on every HTML response.
• Automated Bot Shield protection on link redirects.
• Append-only audit logging for account actions.