How we keep
Lock Leaks secure

Overview

Security is part of how we protect creators. This page covers our technical measures and how to report issues. For our wider promises on identity, takedowns and misuse, see Trust & Safety.

How we protect data

• encryption in transit (TLS) and at rest;
• two-factor sign-in for accounts;
• role-based access for staff, with every action written to an audit log;
• evidence stored with a fingerprint (hash), so it cannot be changed unnoticed;
• regular backups;
• card payments handled by our payment provider, never stored by us.

Keeping your account safe

• use a long, unique password and turn on two-factor sign-in;
• create separate API keys for each tool, and read-only keys where you can;
• remove keys and team members you no longer need;
• we will never ask for your password by email or chat.

Report a security issue

Write to support@lockleaks.com with the subject “Security”. Include what you found, the steps to reproduce it and the impact you expect. We will confirm we received it within 2 working days and keep you updated until it is fixed.

Rules for research

• only test with accounts you own;
• do not access, change or delete other people's data;
• no denial-of-service, spam or social engineering;
• give us reasonable time to fix the issue before you share it publicly.

Safe harbor

If you follow these rules and act in good faith, we will not take legal action against you for your research, and we will work with you to understand and fix the issue.

Out of scope

• reports without a clear security impact, such as missing headers alone;
• self-XSS, clickjacking on pages without sensitive actions;
• rate limits on non-sensitive endpoints;
• issues in third-party services we do not control.

Contact

Security questions: support@lockleaks.com, subject “Security”.