Reporting a security problem in Leave.

1. How to report

Email security@leaveyouragent.com. To encrypt a report, use our OpenPGP key at /.well-known/security-key.asc; its fingerprint is AA85 600E 85B6 D520 CDED D11D 027D E4E4 B81F 1D74. You can report anonymously; we only need a way to reach you if you want updates or credit.

A useful report says where the problem is (the address, the app screen, the file in a public repo), what happens, and how to reproduce it. A short proof is enough. Please do not include another person's data.

2. What to expect

• We confirm we received your report within 2 business days.
• We tell you our first assessment within 10 business days: whether we can reproduce it, how serious we think it is, and roughly when a fix is planned.
• We keep you updated until it is fixed, and we tell you when it is.
• If you want, we name you on our thanks page once the fix is out.
• There is no paid bounty today. If that changes, it will be announced here first.

3. Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not recommend or pursue legal action against you for it, and if someone else starts legal action over research that followed this policy, we will say that it was authorized.

4. What is in scope

• leaveyouragent.com and its pages
• api.leaveyouragent.com
• mcp.leaveyouragent.com
• The Leave app for iPhone and Android, including its encryption code published at github.com/LeaveYourAgent/leave-crypto
• The design documents at github.com/LeaveYourAgent/leave-security

Anything not listed is out of scope.

5. What is out of scope

These belong to other companies. Please report problems in them to those companies (links below), not to us.

• auth.leaveyouragent.com beyond ordinary sign-in: the sign-in service is run by WorkOS (workos.com/security/responsible-disclosure)
• Stripe, Apple and Google Play payment systems (stripe.com/security; security.apple.com; google.com/about/appsecurity)
• Cloudflare's own systems (cloudflare.com/disclosure)
• Google Cloud's own systems (bughunters.google.com)

6. What you may do

• Test only with accounts you created and own, and only with made-up data. Sample contracts to upload are fine; a real person's contract is not.
• Stop and tell us the same day if you reach another person's data by accident. Do not read further, copy, or keep it.
• Keep proof to the minimum. One record you own is enough to show a problem.
• Give us time to fix a problem before you describe it publicly. We will agree a date with you; 90 days from your report is the usual outer limit, and sooner is welcome once a fix is out.

7. What you may not do

• Denial of service, load testing, or anything that degrades the service for others
• Social engineering, phishing, or physical attacks on anyone, including our vendors
• Testing with another person's account, or any action on data that is not yours
• Automated scanning at a rate that trips our rate limits
• Running exploits past the point of demonstrating the problem, installing anything that persists, or moving data out beyond your own single record

8. Our side

Security at Leave is led by Christopher Ian Horne, founder and Chief Technology Officer. Reports go to him. This policy has not been reviewed by a lawyer; it says what we will do, in plain words, and we will keep it.

Machine-readable details: /.well-known/security.txt. How Leave protects athletes' data is on the security page.

Leave is software. It is not an athlete agent and does not negotiate, represent or arrange deals. It organizes public information and explains terms. Not legal, tax or financial advice.