Level2 Vulnerability Disclosure

generated: '2026-09-17'
method: searched
probe: true
source: >-
  https://www.trylevel2.com/.well-known/security.txt (HTTP 200, text/plain) and the policy it points
  at, https://www.trylevel2.com/security (HTTP 200)
docs: https://www.trylevel2.com/security
description: >-
  Level2 runs a published vulnerability disclosure programme with a named contact, a stated
  acknowledgement target, an explicit in-scope domain list and an in-scope vulnerability-class list.
  It is a coordinated-disclosure programme, not a paid bug bounty.
program:
  type: vulnerability-disclosure
  name: Vulnerability Disclosure Program
  bounty: false
  platform: null
  platform_note: >-
    Not run on HackerOne, Bugcrowd or Intigriti — reports go directly to the security address.
  safe_harbor_stated: false
policy:
  - https://www.trylevel2.com/security
contact:
  - mailto:security@trylevel2.com
preferred_languages:
  - en
response_targets:
  acknowledgement: 72 hours
  quote: 'We aim to acknowledge vulnerability reports within 72 hours.'
  process:
    - Security team reviews the submission and begins investigating.
    - Level2 may contact the reporter for additional information.
    - Verified issues are resolved as quickly as possible.
    - The reporter is notified when the vulnerability has been resolved.
disclosure_terms: >-
  Reporters are asked not to disclose publicly until Level2 has had reasonable time to investigate
  and address the issue.
report_contents_requested:
  - A detailed description of the vulnerability.
  - Step-by-step instructions to reproduce the issue.
  - Proof-of-concept scripts, screenshots or logs.
  - The potential security impact of the issue.
  - Any suggested remediation if available.
scope:
  domains:
    - trylevel2.com
    - '*.trylevel2.com'
  note: >-
    The Bytemine hosts (bytemine.io, guide.bytemine.io, valhalla.bytemine.workers.dev), which carry
    the legacy signal API and its documentation, are NOT named in the in-scope domain list even though
    Bytemine Technologies Ltd is the company behind Level2.
  vulnerability_classes:
    - Authentication bypass or account takeover
    - Broken access control or privilege escalation
    - Insecure Direct Object References (IDOR)
    - Cross-Site Scripting (XSS)
    - Cross-Site Request Forgery (CSRF)
    - Server-Side Request Forgery (SSRF)
    - SQL or NoSQL injection
    - Remote Code Execution (RCE)
    - Sensitive data exposure or unintended information disclosure
    - Subdomain takeover
    - Security misconfigurations with meaningful security impact
evidence:
  - source: https://www.trylevel2.com/.well-known/security.txt
    kind: security.txt (RFC 9116, live probe)
    status: 200
    file: well-known/level2-security.txt
  - source: https://www.trylevel2.com/security
    kind: disclosure policy page (live fetch)
    status: 200