Security and vulnerability disclosure

The text of locker.link/security and locker.link/.well-known/security.txt, operated by Locker.

Report a vulnerability

Email security@locker.link with what you found, how to reproduce it, and the impact you believe it has. Please do not include other people's documents or personal information; a description of what you could access is enough.

Scope

• locker.link, app.locker.link, api.locker.link, locker.link/console
• the upload page at locker.link/u/… and the receipt checker at locker.link/r/…
• the public API and webhooks

Out of scope: denial-of-service and volumetric testing, social engineering of staff or customers, physical attacks, reports from automated scanners without a demonstrated impact, and the platforms Locker runs on (report those to the vendor).

Rules

• Use only accounts and organizations you create. Never access, change or delete another organization's data; stop and report as soon as you see data that is not yours.
• Do not upload malware to a customer's link. Test the upload pipeline only against your own organization.
• Give us reasonable time to fix an issue before disclosing it.

Safe harbour

If you make a good-faith effort to follow this policy, Locker will not pursue or support legal action against you for your research, and will consider it authorized.

What to expect

• Acknowledgement within 3 business days.
• An initial assessment within 10 business days, and updates until the issue is resolved.
• Credit on the security page if you want it.

There is no paid bug bounty yet; one will be considered after the first SOC 2 report.

security.txt

Contact: mailto:security@locker.link
Expires: 2027-09-15T00:00:00Z
Preferred-Languages: en, es
Policy: https://locker.link/security
Canonical: https://locker.link/.well-known/security.txt