Security
Responsible disclosure.
If you believe you have found a security vulnerability in a website or system operated by YBM Labs, we want to hear from you.
How to report
Email security@ybmlabs.com with:
- The affected website or system.
- A description of the issue and its potential impact.
- The steps needed to reproduce it.
- How we can contact you, and whether you would like to be credited.
Our machine-readable contact details are in security.txt.
What we ask of you
- Access or change only the minimum data needed to demonstrate the issue, and delete anything you obtained once reported.
- Do not degrade the availability of our services.
- Do not target our staff, clients or offices, or use social engineering or physical methods.
- Give us reasonable time to fix the issue before telling anyone else about it.
What we commit to
- Acknowledge your report within three business days.
- Keep you informed as we investigate and fix the issue.
- Credit you once it is resolved, if you would like us to.
- Not pursue legal action against good-faith research that follows this policy.
Out of scope
This policy covers our own websites and systems only. It does not authorise testing of our clients' systems, and it does not cover reports from automated scanners without a demonstrated impact. We do not currently run a paid bug bounty programme.