Vulnerability disclosure policy

In scope

• The website yof.io and its pages.
• The yof app at app.yof.io, including its sign-in, your apps and findings, Guard and Patch.
• The command-line tool @yof/cli (yof check, yof attack, the pre-commit hook) and its GitHub workflow step.

Examples we want to hear about: one account seeing another account's apps or findings, yof printing a secret in full anywhere, the CLI sending anything to a host it should not reach, yof attack reaching a host the person did not prove is theirs, or Guard and Patch writing beyond their own comment, check or fix branch.

Out of scope

• Other people's accounts and data, and the apps our users check with yof: test only your own.
• Services we use but do not run, such as GitHub, npm, our hosting and email providers. Report those to them.
• Denial of service, load tests, spam, and social engineering or phishing of our people or users.
• Physical access to offices or devices.
• Reports from automated scanners with no shown impact, missing best-practice headers on pages without sensitive data, and self-XSS.
• A key yof misses or a false alarm: that is a normal bug. Open an issue on the open-source repository, with a fake value and never a real key.

Good-faith research

If you follow this policy, we treat your research as authorised. We will not take legal action against you or report you to the police for it, and we will not ask anyone else to. If someone else brings a claim about research you did under this policy, we will say that it was authorised.

In return, please:

• use only your own accounts and your own apps;
• stop as soon as you reach data that is not yours, do not keep or share it, and tell us;
• do nothing that slows the service down or changes or deletes data that is not yours;
• keep the problem private until it is fixed, or until 90 days after your report, whichever comes first, unless we agree another date with you.

If you are unsure whether something is allowed, ask us first at the address below.

How to report

• Email security@yof.io, or
• use GitHub's private vulnerability reporting on the open-source repository (for the CLI and its GitHub workflow step).

Tell us what you found, where, the steps to reproduce it and what an attacker could do with it. Please do not open a public issue for a security problem.

What happens next

• Within 3 working days: a reply from a person, saying we received your report.
• Within 10 working days: our first assessment, whether we could reproduce it and how serious we think it is.
• At least every 14 days: an update until the problem is fixed or we decide it is not one, with our reasons.
• When it is fixed, we tell you, and we agree with you when and how it is made public.

Thanks and credit

We thank every reporter, and with your permission we credit you by name or handle when the fix is announced. We do not pay rewards today; paid rewards may come later, and this page will say so when they do.

The short version of this policy, with the same address, is on Report a security problem.