Responsible disclosure

How to submit a report

Email info@leadarivo.com with the subject “Security report”.

Helpful reports include the URL or product area, steps to reproduce, what you expected versus what happened, and a brief impact assessment. Do not attach more personal data than needed.

Limit testing to this public website and accounts or synthetic data you control. A report invitation does not authorize access to other customers, Production infrastructure or third-party services. Ask for written scope approval before testing outside those limits. If real customer data appears, stop and report the location with minimal redacted evidence; do not copy or retain it.

Please do not

• Access, copy or modify data that is not yours
• Disrupt the service (including denial-of-service tests against production)
• Exploit a finding beyond what is needed to show it exists
• Publicly disclose an unresolved vulnerability
• Demand payment as a condition of reporting

What you can expect

We will aim to acknowledge a good-faith report. We do not promise a fixed response SLA on this page. We do not offer bug-bounty payments unless a bounty programme is later published here.

We may ask for more detail and coordinate a disclosure approach. Mailbox monitoring and the incident triage workflow must be operationally confirmed; the presence of this contact address is not an attestation of a staffed response service or a safe-harbour agreement.