LinkHunter
Sign in Get Started Free

Security

How LinkHunter protects your account, keys and data — and how to report a vulnerability.

Last updated 2 min read

You trust LinkHunter with your mailbox, your API keys and your prospects’ business details. Here is how we protect them — described plainly, without vague claims.

1. Encryption

In transitAll traffic is served over HTTPS with HSTS. Session cookies are Secure, HttpOnly and SameSite.
Secrets at restAPI keys and mailbox passwords are encrypted with libsodium (XSalsa20-Poly1305) using a server key that never leaves the server. Only the last four characters are ever shown back.
Passwords and tokensPasswords are stored as bcrypt hashes. Session, invitation, verification and reset tokens are stored only as SHA-256 hashes and expire.

2. Application security

  • Tenant isolation: every query is scoped to your workspace, and automated tests check that one workspace can’t read another’s data.
  • Roles and permissions: six roles control who can launch campaigns, approve emails, approve money or manage billing.
  • CSRF protection on every state-changing request, and a strict Content-Security-Policy that blocks inline scripts.
  • SSRF protection: when LinkHunter fetches web pages it refuses private, loopback, link-local and cloud-metadata addresses, pins DNS results and re-checks every redirect.
  • Brute-force limits on sign-in, registration, password reset and other sensitive endpoints, without revealing whether an account exists.
  • Audit log of sign-ins, role changes, approvals, exports and integration changes, with secrets redacted.
  • Session control: see your signed-in devices and sign them out; changing your password signs out every other session.

3. Infrastructure and backups

LinkHunter runs on a dedicated virtual server with a firewall that exposes only the web ports. The database, configuration and logs live outside the public web root. A consistent database backup is taken daily and kept on a rolling basis. Background agents run in a supervised worker process, separate from web requests.

4. Outreach safety

Suppression lists, one-click unsubscribe, per-mailbox sending limits (no rotation), and mandatory human approval for any financial commitment are built in — see the Anti-Spam & Outreach Policy.

5. What you can do

  • Use a long, unique password and sign out of devices you no longer use.
  • Give teammates the least-privileged role they need.
  • Connect mailboxes with app passwords rather than your main password, and rotate API keys if a teammate leaves.

6. Responsible disclosure

If you find a vulnerability, please email support@linkhunter.cc with steps to reproduce. Our security.txt has the same contact. We ask that you:

  • give us reasonable time to fix the issue before disclosing it;
  • avoid accessing or changing other users’ data — use your own accounts;
  • don’t run denial-of-service tests, spam, or social-engineering attempts.

We will acknowledge your report within 3 business days, keep you updated, and credit you if you wish. We will not pursue legal action against good-faith research that follows these guidelines.