Coordinated Vulnerability Disclosure

This policy covers the systems listed below. If you are unsure whether specific code or a system is in scope, ask us at security@yivi.app before testing.

In scope:

• yivi.app and yiviconnect.nl (including any subdomains)
• Mobile apps: iOS and Android (including F-Droid), latest released versions
• Publicly available open-source code, available at https://github.com/privacybydesign

Out of scope:

• Third-party services we use but do not operate (e.g. Github, SMS-provider); report to the vendor
• Denial-of-service (DoS/DDoS) or load testing
• Social engineering, phishing, or physical attacks against staff, offices, or data centers
• Spam or automated scanner output without a demonstrated security impact
• Missing best-practice headers, SPF/DMARC records or TLS configurations without practical exploit
• Clickjacking on pages with no sensitive actions
• Vulnerabilities requiring a rooted/jailbroken device or physical access to an unlocked device

When testing, we ask that you:

• Use only accounts you own or have explicit permission to use. Never access other users’ data.
• Access, modify, or keep only the minimum data needed to show the vulnerability, and stop as soon as you reach sensitive data
• Delete any user data you obtained once your report is resolved
• Avoid degrading service, destroying data, or harming our users’ privacy or experience
• Do not use exploits to pivot, persist, or move laterally inside our systems
• Keep testing traffic under 5 requests per second and identify it with a header such as X-Research: <your handle>
• Keep the vulnerability confidential until we agree on disclosure (see Coordinated disclosure)
• Do not demand payment or make threats in exchange for details of a vulnerability

Vulnerabilities found in our publicly available open-source code can be reported via a GitHub Private Vulnerability Report in the corresponding repository. If reported via this channel, please also send us a notification at security@yivi.app. Before reporting, please check if the vulnerability you found, hasn’t already been reported.

Other kinds of vulnerabilities can be reported via email at security@yivi.app. To encrypt sensitive details, either:

• Use our PGP key when sending an email (available at https://yivi.app/pgp.txt, fingerprint 1EED20E0694E06E29CABB1D6D079227208CF2F90)
• Send a report using https://postguard.eu.

We also publish this contact in https://yivi.app/.well-known/security.txt.

Please include in your report:

• The affected asset (URL, endpoint, app version)
• The type of vulnerability and its potential impact
• Clear steps to reproduce, with any proof-of-concept code, requests, or screenshots
• Whether the issue has been exploited or shared with anyone else
• How you would like to be credited, if at all
• Reports in English are preferred. Anonymous reports are accepted, though we cannot follow up on them.

We aim to handle every report within the time frames given below.

• Acknowledge receipt: 3 business days
• Triage and initial severity assessment: 10 business days
• Status updates: at least every 14 days
• Fix for critical / high severity: 30 days
• Fix for medium / low severity: 90 days

We assess severity using CVSS v4.0. If we cannot meet a target, we will inform you why and give you a revised date. We will let you know when the fix is deployed so you can verify it.

We ask you to wait 90 days from your report, or until a fix is released if sooner, before disclosing publicly. We will agree the disclosure date and content with you.

• If a fix needs more time, we may ask for an extension and will explain why
• If a vulnerability is being actively exploited, we may agree to an earlier disclosure so users can protect themselves
• Where appropriate, we will request a CVE and publish an advisory crediting you
• Please share a draft of any write-up with us beforehand so we can check it for sensitive data

If you make a good-faith effort to follow this policy, we consider your research authorized. Specifically, we will:

• Not pursue or support legal action against you for your research, including under anti-hacking laws or anti-circumvention laws
• Waive any terms of service restrictions that would otherwise prohibit your research, for the limited purpose of that research
• Make clear, if a third party brings legal action against you over research covered by this policy, that you acted under our authorization
• This safe harbor covers only our systems and only what this policy permits. It cannot bind third parties or law enforcement. If in doubt, contact us before acting.

We do not currently offer rewards of any kind. With your permission, we will credit you by name or handle/alias in our security advisory and/or on our Hall of Fame page.

We may update this policy from time to time; the current version is always at https://yivi.app/vulnerability-disclosure.