( Responsible disclosure )
Found a
way in?
We fight attackers for a living, so we take reports about our own security seriously. If you found a vulnerability in yellow-force.com, thank you. Here’s how to tell us.
In scope.
- The pages and client-side code we publish at yellow-force.com. The servers behind it are GitHub’s: report those to GitHub.
Out of scope.
- Services run by others, such as our hosting and email providers. Please report those to them directly.
- Systems of the companies we defend. Never test them under this policy.
- Denial of service, spam, social engineering of our people and physical attacks.
- Automated scanner output without a working proof of impact.
- Missing security headers, email settings (SPF, DKIM, DMARC) or best-practice notes without a demonstrated impact.
How to report.
Email with “Security report” in the subject. Please include:
- What you found and where.
- Steps to reproduce it.
- What an attacker could do with it.
- Your name or handle, if you’d like credit.
What we ask.
- Act in good faith and stay inside this policy.
- Stop as soon as you’ve confirmed the issue, and tell us.
- Don’t access, change or delete data that isn’t yours.
- Don’t degrade the site for anyone else, and keep automated testing light.
- Keep the details private until we’ve fixed it, and give us reasonable time to do so.
What we promise.
- We acknowledge reports quickly and keep you updated until it’s fixed.
- If you follow this policy, we consider your research on what’s in scope authorized. We can only authorize testing of what we own. We won’t take legal action against you or ask anyone else to.
- If someone else takes action against you for research done under this policy, we’ll make clear that you acted with our permission.
- We’ll credit you publicly once it’s fixed, if you want.
Rewards.
We don’t pay bounties. We do say thank you, and we mean it.
Machine-readable.
Our contact details are also published at /.well-known/security.txt.