Report a Security Vulnerability

Report a suspected Leadping vulnerability without exposing data, disrupting service, or testing systems without authorization.

Email suspected Leadping security issues to [e-mail].

This reporting channel does not authorize scanning, probing, exploitation, disruption, or access to accounts, data, integrations, carriers, providers, or systems you do not own.

​

Include in the report

• what you observed;
• the affected account, source, integration, number, page, endpoint, or workflow, if safe to share;
• the approximate date, time, and time zone;
• steps needed to reproduce the issue using only authorized access;
• request IDs, timestamps, screenshots, or redacted logs; and
• contact information for follow-up.

Do not email passwords, full keys, tokens, payment-card data, private keys, or another customer’s information. Leadping can provide a safer transfer method if sensitive evidence is required.

​

Stop testing when

• you encounter data or access outside your account;
• continued activity could change or delete data;
• the test could affect service availability;
• the issue involves a third-party system; or
• Leadping asks you to stop.

Preserve the minimum evidence needed and report the issue.

​

Prohibited activity

Do not:

• access, copy, modify, delete, export, or disclose data that is not yours;
• bypass authentication, authorization, billing, carrier, compliance, rate-limit, or abuse controls;
• run automated scans, denial-of-service tests, spam, credential stuffing, or password spraying;
• test customer systems, carriers, providers, or other third parties without their authorization;
• socially engineer or phish employees, customers, providers, or partners; or
• disclose vulnerability details publicly before Leadping has investigated.

Leadping may block, suspend, or investigate harmful, abusive, unlawful, or unauthorized activity.

​

What happens next

Leadping reviews the report and may request clarification. Depending on the issue, Leadping may contain risk, rotate credentials, restrict access, coordinate with providers, notify affected parties, or take other protective action.

Leadping may withhold internal findings, customer data, infrastructure details, provider information, or remediation specifics when disclosure would create additional risk.

Related information: Security, Privacy Policy, Acceptable Use Policy, and Terms of Service.

​

Report format

Subject: Security report — <short description>
Affected Leadping page or API operation:
Observed at (include time zone):
Expected behavior:
Observed behavior:
Minimal reproduction using my authorized account:
Potential impact:
Redacted evidence or request IDs:
Contact for follow-up:

If you accidentally encounter another customer’s information, describe the type of information and where it appeared without copying its contents into the report. Stop at the evidence already observed; further access is not needed to establish that a report should be made.