Trust and safety

Report a link

Anyone can report a Brevily link. You do not need an account, and you do not need to be sure.

Start a report

Any Brevily link: go.surl.mx, the other Brevily domains or a brand’s own domain. Capitals matter. Do not open it again to check.

The form opens on console-uat.brevily.com/report with the link filled in. It takes a minute.

What the form asks

What is wrong with the link, one of five:

  • Phishing or credential theftA page pretending to be a bank, a login, a wallet or a payment form.
  • Malware or unwanted softwareDrive-by downloads, installers, browser hijacking.
  • SpamThe link arrived in bulk email, SMS or comment spam.
  • Illegal contentChild abuse material, threats, fraud or other unlawful content. Describe it; don’t include it.
  • Something elseSay what it is below, so the reviewer knows what to look for.

Then, both optional: what you saw (text, never passwords or card numbers), and your email, stored encrypted and never shown to the link’s owner. You get a reference such as RPT-7KQ3M9XA; reporting the same link again from the same connection, while its report is open, gives the same one.

What happens next

  1. A person reviews itReports join the review queue in the order they arrive.
  2. Three reports trigger a safety checkReports from three different connections send the destination for an immediate safety check.
  3. Harmful destinations are stoppedEvery link to it, in every organisation, shows a warning page instead of redirecting, and no new link can point there.
  4. A report alone never stops a linkA reviewer or the safety check decides. The link’s owner is never told who reported it.

Before you report

  • See where it goes without going there: add a + to the end of the short link, so go.surl.mx/q3-launch becomes go.surl.mx/q3-launch+. You get a page naming the destination instead of the redirect.
  • Not a Brevily link? Report it to whoever runs that domain. Brevily can act only on links it redirects.
  • Already entered a password or card number? Tell your bank or that service first, then report the link.

A vulnerability in Brevily itself

Write to security@brevily.com instead. Nobody who reports one in good faith and allows reasonable time to fix it will be pursued.

What gets a link stopped · How Brevily handles safety

Are you sure?