linear.app Security Audit on CyberFurl

Preparing the security report

Privacy controls

CyberFurl can load analytics only after you opt in. Core product features work without analytics consent.

linear.app Security Audit — DNS, Email & SSL Report

Security report

Completed

CyberFurl completed the core public checks, but the combined audit score is still calculating while the remaining weighted evidence is validated.

Unified external risk score across DNS, email, web, malware, breach exposure, and technical readiness signals. Final scoring will publish once the remaining evidence settles.

Monitor DomainCheck another

Latest report

Ready to share

8/23/2026, 3:04:42 PM UTC

Coverage

7/7 stages

100% collected

Leading signal

Still evaluating

Waiting for scored data

Priority area

Still evaluating

DNS settings need attention

Immediate priority

DNS settings need attention

DNSSEC is not enabled.

Email the full report to get the DNS fix checklist.

Score status

Latest saved external posture

8/23/2026, 3:04:42 PM UTC

—Combined scoreCalculating7/7 stages

Coverage7/7 stages

Signals5 surfaced

StatusScore will publish as the remaining evidence settles

Email security

CyberFurl checks the public email authentication records for linear.app including SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These protocols determine whether emails from linear.app can be trusted by receiving mail servers and whether they are likely to reach the inbox or be flagged as spam.

Email score

—/N/A

Risk level

Pending

Key finding

Email protection needs attention

Get the full email deliverability breakdown in the PDF report

Public findings

Issues at a glance

A public summary of the checks that surfaced the strongest visible signals in this report.

Check

Status

Severity

Explanation

DNS settings need attention

Review

warning

Business Impact: DNS hijacking risk and potential downtime. DNSSEC is not enabled.

Email protection needs attention

Review

warning

Business Impact: Attackers may impersonate your domain in phishing campaigns. Missing controls: SPF, DKIM, DMARC…

Web security needs attention

Review

warning

Business Impact: Increased exposure to browser-based attacks. Present: HSTS, CSP, X-Content-Type-Options, Referr…

4 issues found that need attention

Get the full remediation workbook with step-by-step fixes delivered to your inbox.

View Complete Findings

Executive summary

CyberFurl is still gathering trustworthy public posture evidence for linear.app. Keep this tab open while the combined audit stages finish collecting evidence.

Email the full report for the business summary, supporting context, and prioritized actions.

Control and exposure map

One primary exposure, one strongest control, and the remaining stages arranged as report rows instead of equal-weight dashboard tiles.

Primary exposure

DNS posture

Failed

DNS settings need attention

—

Scan failed · partial data

DNSSEC

Not enabled

Resolver and record checks were included in this audit.

DNSSEC

Off

Resolver health

Unknown

Strongest control

Email authenticity

SPF, DKIM, DMARC, and MX coverage were included.

—

Scan failed · partial data

Audit frame

Coverage

100% collected

7/7 stages

Signals

4 issues to review

Freshness

Ready to share externally

Checked today

Web security

Failed

Web security needs attention

—

Scan failed · partial data

HSTSPresent

CSPPresent

Present: HSTS, CSP, X-Content-Type-Options, Referrer-Policy. Missing: X-Frame-Options, Permi…

Malware intelligence

Limited detail

Threat telemetry is still being validated

—

Scan failed · partial data

Signals0

VerdictUnknown

Threat-feed telemetry and blacklist reputation were reviewed without an active hit.

Supporting evidence

Domain, infrastructure, and incident proof

Saved signals that support the scored audit without introducing another score layer.

Email Authentication (SPF, DKIM, DMARC)

Public section

Email security deep dive

Status

completed

Saved SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, DANE, and MX evidence was included from the latest shared email scan.

Included in the current public preview

SPF recordMissing

DKIM selectorsMissing

DMARC pMissing

DMARC spNot set

DMARC pct100

DMARC ruaNot set

DMARC rufNot set

MX routes0

BIMIUnknown

MTA-STSUnknown

TLS-RPTUnknown

DANEUnknown

DMARC policyp= pct=100 rua= ruf=

DNS Configuration

Public section

DNS Records snapshot

Saved DNS records were included from the latest shared DNS scan.

Included in the current public preview

completed

SSL/TLS Certificate

Public section

SSL/TLS certificate panel

Saved certificate validity, protocol support, negotiated cipher, and transport-hardening evidence was included from the latest TLS scan.

Included in the current public preview

completed

IssuerCN=YE2,O=Let's Encrypt,C=US

Valid fromJune 17, 2026

Valid toSeptember 15, 2026

Days remaining81 days · Caution

TLS versionsTLSv1.3, TLSv1.2

Cipher suite gradeA+

Negotiated cipherTLS_AES_256_GCM_SHA384

HSTSMissing

OCSP staplingUnknown

CT logsUnknown

Accepted cipherTLS_AES_256_GCM_SHA384

Certificate

SubjectCN=linear.app

IssuerCN=YE2,O=Let's Encrypt,C=US

TLS Protocols

TLSv1.3Supported

TLSv1.2Supported

TLSv1.1Not supported

TLSv1.0Not supported

Cipher Suites

Cipher

Protocol

Strength

TLS_AES_256_GCM_SHA384TLSv1.3strong

ECDHE-ECDSA-AES256-GCM-SHA384TLSv1.2strong

ECDHE-RSA-AES256-GCM-SHA384TLSv1.2strong

ECDHE-ECDSA-CHACHA20-POLY1305TLSv1.2strong

ECDHE-RSA-CHACHA20-POLY1305TLSv1.2strong

ECDHE-ECDSA-AES128-GCM-SHA256TLSv1.2strong

ECDHE-RSA-AES128-GCM-SHA256TLSv1.2strong

ECDHE-ECDSA-AES256-SHA384TLSv1.2strong

ECDHE-RSA-AES256-SHA384TLSv1.2strong

Subject Alternative Names (2)

*.client-preview.linear.applinear.app

Web Security Headers

Security Headers

Strict-Transport-Security

PRESENT

max-age=63072000; includeSubDomains

Content-Security-Policy

PRESENT

default-src 'self' https://static.linear.app https://static.linear.dev; connect-src 'self' https://o415358.ingest.sentry.io/api/5337513/ https://o415358.ingest.sentry.io/api/4504277957279744/ wss://ornj730p.api.sanity.io/ https://ornj730p.apicdn.sanity.io/ https://*.linear.app https://9RXBCYQ6DV-dsn.algolia.net https://linearstatus.com/ https://statuspage.incident.io/ https://app.posthog.com https://api.github.com/ https://raw.githubusercontent.com/ https://www.githubstatus.com/ https://dns.google/ http://127.0.0.1:44450/ http://127.0.0.1:18450/ http://127.0.0.1:33234/ https://api.linear.app https://client-api.linear.app wss://sync.linear.app/ https://storage.googleapis.com/uploads.linear.app/ https://storage.googleapis.com/linear-uploads-europe-west1/ https://storage.googleapis.com/linear-uploads-us-central1/ https://storage.googleapis.com/imports.linear.app/ https://storage.googleapis.com/linear-imports-europe-west1/ https://storage.googleapis.com/linear-imports-us-central1/ https://storage.googleapis.com/public.linear.app/ https://ornj730p.api.sanity.io/; script-src 'unsafe-inline' 'self' blob: https://js.stripe.com/v3 https://jobs.ashbyhq.com/Linear/embed https://e.linear.app https://challenges.cloudflare.com/turnstile/ 'wasm-unsafe-eval' https://static.linear.app https://static.linear.dev; worker-src 'self' blob: https://static.linear.app https://static.linear.dev; style-src 'self' 'unsafe-inline' https://static.linear.app https://static.linear.dev; font-src 'self' data: https://static.linear.app https://static.linear.dev; img-src 'self' data: blob: https://*.linear.app https://*.googleusercontent.com https://cdn.sanity.io/images/ornj730p/ https://webassets.linear.app https://linear.app/cdn-cgi/imagedelivery/ https://avatars.githubusercontent.com https://i.ytimg.com/vi/ https://avatars.slack-edge.com https://pbs.twimg.com/profile_images/ https://pbs.twimg.com/ext_tw_video_thumb/ https://secure.gravatar.com; frame-ancestors 'self' https://cms.linear.app; frame-src *; media-src blob: https://uploads.linear.app https://client-api.linear.app https://public.linear.app https://imports.linear.app https://static.linear.app https://webassets.linear.app https://cdn.sanity.io/files/ornj730p/ https://video.twimg.com/ext_tw_video/ https://linear.app/static/; base-uri 'self'; report-uri https://api.linear.app/report-violation

X-Content-Type-Options

PRESENT

nosniff

Referrer-Policy

PRESENT

same-origin

Cache-Control

PRESENT

s-maxage=1800, stale-while-revalidate

Server

PRESENT

cloudflare

X-Frame-Options

MISSING ESSENTIAL

Permissions-Policy

MISSING ESSENTIAL

All Response Headers19 headers

Strict-Transport-Security

PRESENT

max-age=63072000; includeSubDomains

Content-Security-Policy

PRESENT

X-Content-Type-Options

PRESENT

nosniff

Referrer-Policy

PRESENT

same-origin

Cache-Control

PRESENT

s-maxage=1800, stale-while-revalidate

Server

PRESENT

cloudflare

Alt-Svc

PRESENT

h3=":443"; ma=86400

CF-Cache-Status

PRESENT

DYNAMIC

CF-Ray

PRESENT

a1acaca6eb038bc3-IAD

Connection

PRESENT

keep-alive

Content-Encoding

PRESENT

Content-Type

PRESENT

text/html; charset=utf-8

Date

PRESENT

Tue, 14 Jul 2026 01:15:06 GMT

Link

PRESENT

<https://static.linear.app/fonts/InterVariable.woff2?v=4.1>; rel=preload; as="font"; crossorigin="anonymous"; type="font/woff2", <https://static.linear.app/web/_next/static/css/Providers.qSrgnk7B.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Toast.pcGZUK31.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Grid.Cds8fjKR.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/StatusPage.BYDaMjMd.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Link.Tpxbzi3N.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/utils.5l1Pf81z.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Button.dcAi4KbO.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Header.DrX8EJz9.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Flex.BEZjGLsi.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/ThemeToggle._YM9yPbG.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/IconButton.3p32EmO1.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/KBD.ByHmXOx_.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Tooltip.mgHd0F-S.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Icon.Bl8l9ltc.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/color.C-dCEHFh.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/Spacer.mYgpGelO.css>; rel=preload; as="style", <https://static.linear.app/web/_next/static/css/index.CcvuW808.css>; rel=preload; as="style"

Transfer-Encoding

PRESENT

chunked

Vary

PRESENT

RSC, Accept, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch, Next-Url, X-Vinext-Interception-Context, X-Vinext-Mounted-Slots, X-Vinext-Rsc-Render-Mode, Accept-Encoding

Via

PRESENT

1.1 google

x-nextjs-cache

PRESENT

HIT

x-vinext-cache

PRESENT

HIT

Infrastructure & Other Headers13 headers

Alt-Svc

PRESENT

h3=":443"; ma=86400

CF-Cache-Status

PRESENT

DYNAMIC

CF-Ray

PRESENT

a1acaca6eb038bc3-IAD

Connection

PRESENT

keep-alive

Content-Encoding

PRESENT

Content-Type

PRESENT

text/html; charset=utf-8

Date

PRESENT

Tue, 14 Jul 2026 01:15:06 GMT

Link

PRESENT

Transfer-Encoding

PRESENT

chunked

Vary

PRESENT

RSC, Accept, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch, Next-Url, X-Vinext-Interception-Context, X-Vinext-Mounted-Slots, X-Vinext-Rsc-Render-Mode, Accept-Encoding

Via

PRESENT

1.1 google

x-nextjs-cache

PRESENT

HIT

x-vinext-cache

PRESENT

HIT

Subdomains & Infrastructure

Public section

IP intelligence

Saved resolved IP, ASN, provider, and location evidence was included from the latest shared infrastructure snapshot.

Included in the current public preview

completed

Resolved IPs (3)

104.18.40.45

1.1.1.1

172.64.147.211

Hosting Provider

Cloudflare

Organization

Cloudflare, Inc.

ASN

AS13335

Country

United States

Infrastructure

Unknown

Reverse DNS

linear.app

SubdomainDiscovery

Subdomain footprint

10 public hostnames were included in the latest saved enumeration snapshot.

Saved 7/14/2026, 1:15:19 AM UTC

Completed

Discovered10

Subdomain inventory (10)

Subdomain

IP Address

Status

linear.app104.18.40.45Live

tim.ns.cloudflare.com—Live

zara.ns.cloudflare.com—Live

www.linear.app104.18.40.45Live

test.linear.app1.1.1.1Live

sandbox.linear.app172.64.147.211Live

public.linear.app172.64.147.211Live

images.linear.app172.64.147.211Live

docs.linear.app172.64.147.211Live

api.linear.app172.64.147.211Live

PortScan

Network exposure

4 open port(s) and 0 closed port(s) found in the latest saved port scan.

Saved 7/14/2026, 1:15:19 AM UTC

Completed

Total Open Ports

Total Closed Ports

Filtered / Blocked

Open Ports (4)

http

open

80/TCP

Banner:Cloudflare http proxy

https

open

443/TCP

http

open

8080/TCP

Banner:Cloudflare http proxy

https-alt

open

8443/TCP

All Scanned Ports7 total ports

Port

Protocol

Service

State

21tcp—filtered

22tcp—filtered

25tcp—filtered

TracerouteAPI

Network route telemetry

Traceroute collected 0 hop(s) but did not confirm destination.

Saved 6/25/2026, 11:24:37 PM UTC

Completed

Hop Count

Route Reached

Avg RTT

0.0 ms

Min RTT

0.0 ms

Max RTT

0.0 ms

First Hop

Unknown

Final Hop

Unknown

WHOIS & Registration

Public section

WHOIS panel

Saved registrar, lifecycle, and nameserver evidence was included from the latest WHOIS lookup.

Included in the current public preview

completed

Registrar

Cloudflare, Inc.

Privacy Protection

Yes

Expiry Health

1355 days · Healthy

Created

May 9, 2018

Updated

May 28, 2026

Expires

May 9, 2030

Nameservers (2)

tim.ns.cloudflare.com

173.245.59.145, 172.64.33.145, 108.162.193.145, 2803:f800:50::6ca2:c191, 2a06:98c1:50::ac40:2191, 2606:4700:58::adf5:3b91

zara.ns.cloudflare.com

172.64.32.148, 108.162.192.148, 173.245.58.148, 2606:4700:50::adf5:3a94, 2a06:98c1:50::ac40:2094, 2803:f800:50::6ca2:c094

EPP Status Codes

client

Immediate priorities

DNS settings need attention

Business Impact: DNS hijacking risk and potential downtime.
DNSSEC is not enabled.

Warning

Next step

Email the full report to get the DNS fix checklist.

Email protection needs attention

Business Impact: Attackers may impersonate your domain in phishing campaigns.
Missing controls: SPF, DKIM, DMARC.

Warning

Next step

Email the full report to get the email authentication checklist.

Web security needs attention

Business Impact: Increased exposure to browser-based attacks.
Present: HSTS, CSP, X-Content-Type-Options, Referrer-Policy. Missing: X-Frame-Options, Permissions-Policy.

Warning

Next step

Email the full report to get the web hardening checklist.

Report context

Frequently Asked Questions

Is linear.app safe?

CyberFurl has collected publicly observable security signals for linear.app but a final composite score has not yet been computed. The report covers DNS, email authentication, web security headers, and SSL/TLS evidence gathered on August 23, 2026 at 3:04 PM UTC.

Is DNSSEC enabled on linear.app?

No. CyberFurl found that DNSSEC is not enabled on linear.app (status: unsigned). Without DNSSEC, DNS responses cannot be cryptographically verified, leaving the domain potentially vulnerable to cache-poisoning and man-in-the-middle attacks on DNS resolution.

Does linear.app use HTTP security headers?

CyberFurl scanned the HTTP response headers served by linear.app. 4/6. Properly configured security headers protect visitors from clickjacking, cross-site scripting, and information disclosure.

Does linear.app use a valid SSL/TLS certificate?

CyberFurl verified the TLS configuration for linear.app: certificate issued by CN=YE2,O=Let's Encrypt,C=US. A trusted TLS certificate ensures that traffic between visitors and linear.app is encrypted and that the server identity is verified.

Who is the registrar for linear.app?

linear.app is registered with Cloudflare, Inc.. The registration is scheduled to expire on Active. CyberFurl monitors WHOIS records to detect registrar changes, upcoming expirations, and domain status flags that could affect security.

When does linear.app's domain registration expire?

According to CyberFurl's WHOIS lookup, the linear.app registration expires on Active. Expired domains can be snatched by attackers for phishing or malware distribution. CyberFurl can alert you as the expiration date approaches.

How many subdomains were discovered for linear.app?

CyberFurl's passive enumeration discovered 10 subdomains associated with linear.app. Examples include: linear.app, tim.ns.cloudflare.com, zara.ns.cloudflare.com. The full inventory appears in the infrastructure evidence section. Unmonitored subdomains are a common blind spot — expired certificates or misconfigured services on forgotten subdomains can become silent entry points for attackers.

What ports are exposed on linear.app?

CyberFurl's network scan found 4 open ports on linear.app. Exposed services: 80/tcp (http), 443/tcp (https), 8080/tcp (http), 8443/tcp (https-alt). Open ports represent potential entry points for attackers. Unused services should be closed and exposed services kept patched and monitored continuously.

When was linear.app last scanned by CyberFurl?

The current public report for linear.app reflects security data collected on August 23, 2026 at 3:04 PM UTC. CyberFurl continuously refreshes public reports as new evidence is gathered. Enable continuous monitoring to receive real-time alerts the moment security-relevant changes are detected.

How does CyberFurl collect security information about linear.app?

CyberFurl relies exclusively on publicly observable signals — no intrusive probing or credentials are required. Data sources include: DNS record queries (A, AAAA, MX, TXT, NS, CAA, PTR), SSL/TLS certificate inspection via standard TLS handshake, HTTP response header analysis, WHOIS registry lookups, passive subdomain enumeration, non-intrusive port reconnaissance, network route telemetry (traceroute), and public threat intelligence feeds.

Why can security findings change between scans for linear.app?

Security posture is dynamic. Findings for linear.app can change when: SSL/TLS certificates are renewed or expire, DNS records are updated (MX, SPF, DMARC, NS changes), new subdomains are provisioned or decommissioned, HTTP security headers are added or removed from server configuration, hosting or CDN infrastructure changes, or threat intelligence databases are updated with new indicators of compromise.

Can I monitor linear.app for security changes?

Yes. CyberFurl's continuous monitoring tracks DNS record changes, SSL/TLS certificate expiry and reissuance, email authentication policy updates (SPF, DKIM, DMARC), WHOIS registration changes, new subdomain discoveries, open port changes, and threat intelligence hits for linear.app. Enable continuous monitoring to receive alerts the moment security-relevant changes occur.

Learn More

DMARC DKIM DNSSEC CVE Database OWASP Top 10 DDoS Mitigation TLS/SSL Security

linear.app External Security Audit & Risk Exposure Report

linear.app Email Deliverability & DMARC Authentication

Issues at a glance

linear.app Executive Summary & Key Threat Intelligence

linear.app Attack Surface: DNS, Web & Exposure Analysis

DNS posture

Email Authentication (SPF, DKIM, DMARC)

DNS Configuration

SSL/TLS Certificate

Web Security Headers

Security Headers

Subdomains & Infrastructure

Open Ports (4)

WHOIS & Registration

linear.app Vulnerability Fixes & Recommended Actions

Frequently Asked Questions

Related Reports

Learn More