Security
Security and responsible disclosure
Last updated: July 30, 2026
Protecting customer and monitoring data is central to LookalikeAlert. This page explains our security approach and how to report a suspected vulnerability.
Security measures
- Encrypted HTTPS transport and secure session-cookie settings in production.
- Industry-standard password hashing and role-based organization access.
- Restricted administrative access, request validation, and protection against common web attacks.
- Separated secrets and environment configuration, dependency maintenance, logging, and operational health monitoring.
- Data minimization and retention limits for temporary links and screenshot evidence.
- Payment-card processing delegated to Stripe; LookalikeAlert does not store complete card details.
Report a vulnerability
Email info@optimaize.io with the affected URL or component, a clear description, reproduction steps, impact, and any supporting evidence. Please do not include unnecessary personal data, credentials, or live secrets. Our machine-readable contact is available at /.well-known/security.txt.
Safe-harbor expectations
Act in good faith, test only what is necessary, avoid privacy violations and disruption, do not access or modify data belonging to others, and stop if you encounter sensitive information. Do not use denial-of-service, social engineering, physical attacks, malware, automated high-volume scanning, or extortion. Give us reasonable time to investigate before public disclosure.
What to expect
We aim to acknowledge credible reports within five business days, assess severity, and provide progress updates where practical. Resolution time depends on complexity and risk. We do not promise payment or a bounty, but we value responsible reports and may recognize researchers with permission.
Support and abuse
For account support, suspected phishing domains, or misuse of LookalikeAlert, contact info@optimaize.io. The vulnerability channel is intended for security weaknesses in LookalikeAlert itself.