At Yipy, we take the security of our systems and user data seriously. We value the security community and are committed to working with researchers to verify and fix vulnerabilities.
If you believe you have found a security vulnerability in the Yipy platform, we encourage you to let us know straight away. We will investigate all legitimate reports and do our best to quickly fix the problem.
1. Rewards & Bounties
We believe in rewarding security researchers for their time and effort whenever possible.
- Discretionary Rewards: We offer monetary rewards for valid, high-severity vulnerabilities. The amount is determined entirely at our discretion based on the severity, impact, and quality of the report.
- No Hard Limits: We do not publish a fixed pay table. We aim to be fair while working within a limited startup budget.
- Swag & Recognition: For valid reports where a cash bounty is not feasible, we may offer company swag or a recommendation letter/acknowledgment if desired.
- Exclusions: We typically do not offer rewards for low-severity issues, best-practice configuration suggestions, or bugs found by automated scanners.
- Hall of Fame: With your permission, we will publicly acknowledge researchers who have helped us secure our platform.
2. Scope
Please review what is considered in-scope and out-of-scope before submitting a report.
2.1 In Scope
We are interested in critical bugs that affect user data or platform integrity, such as:
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS) affecting other users
- Remote Code Execution (RCE)
- Authentication or Authorization Bypasses (IDOR)
- Sensitive Data Exposure
2.2 Out of Scope
The following issues are considered known/low-risk or false positives and are usually not eligible for rewards
- Missing email authentication records (SPF, DMARC, DKIM).
- Missing security headers (e.g., HSTS, X-Frame-Options) without a working Proof of Concept.
- Clickjacking on pages with no sensitive actions.
- Reports generated entirely by automated scanners.
- Social engineering, phishing, or physical attacks against our employees.
- Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks.
- Self-XSS (XSS that requires the user to attack themselves).
3. Reporting Guidelines
To report a vulnerability, please follow these steps:
- Send your report via email to [email protected].
- Include a Proof of Concept (PoC). This should be a clear description or video demonstrating how the vulnerability can be reproduced.
- If possible, include the specific URL or endpoint affected.
- Do not access, download, or modify user data that does not belong to you.
4. Safe Harbor
If you conduct your research and reporting in accordance with this policy, we will consider your work to be authorized. We will not pursue legal action against you regarding your research, provided that you:
- Act in good faith to avoid privacy violations or destruction of data.
- Do not interrupt or degrade our services (e.g., DoS attacks).
- Give us a reasonable amount of time to fix the issue before making it public.