Report a security problem

How to report

• Email security@mondaily.com, or
• use GitHub's private vulnerability reporting on the open-source repository.

Please don't open a public issue for a security problem. Tell us what you found, how to reproduce it and what an attacker could do with it. We credit reporters who want to be credited.

Scope

• The yof app and the website at yof.io, and the checks yof runs.
• Guard, our GitHub app yof by sotem.
• The @yof/cli command-line tool and its GitHub workflow step (github.com/yof-dev/yof).

Examples we want to hear about: yof printing a secret in full anywhere, yof sending anything to a host it shouldn't reach, one account seeing another account's apps or findings, or Guard or Patch writing anything beyond its one comment, its one check or its own fix branch.

A key yof misses, or a false alarm, is a normal bug: open an issue on the repository, with a fake value and never a real key.

Good-faith research

If you look for problems in good faith, follow this page and report what you find to us privately, we won't take legal action against you or ask anyone else to. In return, please:

• test only against your own account and your own apps;
• don't read, change or delete other people's data, and stop and tell us if you reach any;
• don't degrade the service for others (no load testing, no spam);
• give us a fair chance to fix the problem before you talk about it in public.

More

Our machine-readable contact file is at yof.io/.well-known/security.txt. How Mondaily, the company behind yof, handles security and which providers it uses: Mondaily security.

If yof found a real key in your own code, treat it as leaked even if the repository is private: rotate it in the provider's dashboard first, then remove it from the code. Removing it from the latest commit does not remove it from git history.