Security & Responsible Disclosure

Last updated: 24 July 2026

Reporting a vulnerability

Email security@dfacto.ai with details and reproduction steps. We aim to acknowledge within 2 business days and will keep you updated until resolution.

Scope

The Linkfuse applications, CLI, licence issuing endpoint, and this website.

Safe harbour

We will not pursue action against researchers who act in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.

Our design posture

Linkfuse has no server that carries user traffic and collects no personal data, which removes entire classes of risk by construction. Licences verify offline against an embedded public key; the signing key is held server-side only.