Responsible disclosure

How to submit a report

Email info@LeadArivo.com with the subject “Security report”. A dedicated security@ mailbox is not published because it is not a verified active alias.

Helpful reports include the URL or product area, steps to reproduce, what you expected versus what happened, and a brief impact assessment. Do not attach more personal data than needed.

Please do not

• Access, copy or modify data that is not yours
• Disrupt the service (including denial-of-service tests against production)
• Exploit a finding beyond what is needed to show it exists
• Publicly disclose an unresolved vulnerability
• Demand payment as a condition of reporting

What you can expect

We will aim to acknowledge a good-faith report. We do not promise a fixed response SLA on this page. We do not offer bug-bounty payments unless a bounty programme is later published here.

We may ask for more detail. If the report is valid, we will work to fix it before any coordinated disclosure.