Responsible disclosure

Draft, last updated Oct 14, 2026.

How we scan

Our scanner identifies itself with the User-Agent LeakyVibesScanner/0.1, only makes GET/HEAD requests, caps each scan at 30 requests, and never scans private network addresses.

Opting out

Site owners can ask us to never scan their domain. Email us and we add it to our blocklist within 24 hours.

If we find a problem on someone else's site

We never publish secrets, URLs or identifying details of issues on sites we don't own. Before mentioning any finding publicly (even anonymized, in aggregate stats) we privately notify the owner and wait at least 30 days or until it's fixed.

Found a bug in LeakyVibes?

Email security@leakyvibes (placeholder) with the details. Please don't access other users' data, run automated scans against us, or disrupt the service. We'll reply within 3 business days, keep you updated, credit you if you want, and won't pursue legal action for good-faith research that follows this policy.