-The URL returned by the quick link service is a bearer secret: anyone who possesses the link can initiate, complete, or cancel the associated liveness session. If a malicious party intercepts the link before the intended user opens it, they can consume or spoof the session and prevent the legitimate user from completing the check—creating a repudiation and impersonation risk rather than exposing biometric data. To minimize this risk, transmit the link only over protected channels, avoid persisting it in logs or analytics, and, when possible, lowering lifetime of the liveness session.
0 commit comments