Vulnerability Disclosure Policy

You may test YetOnePro using only accounts you own and data you control, subject to the rules below. This permission does not extend to other users’ accounts or data, or to third-party services.

• Do not perform denial-of-service (DoS or DDoS) attacks or tests that disrupt availability.
• Do not use social engineering, phishing, or impersonation of staff or users.
• Do not perform destructive testing or delete, corrupt, or modify other users’ data.
• Do not send spam, mass messages, or repeated email or notification requests.
• Do not access, download, or retain other users’ private data.

If you unexpectedly encounter another user’s data, stop testing immediately and report the issue. Do not investigate further or include that private data in your report.

Email business@yetone.pro with a clear summary and:

• The affected URL, endpoint, or feature.
• Steps to reproduce using your own accounts and test data, including any prerequisites.
• The expected behavior, observed behavior, and practical security impact.
• A minimal proof of concept, or relevant requests, responses, and screenshots with sensitive values redacted.
• A way to contact you with follow-up questions.

Do not send passwords, access tokens, or other users’ personal information. Please report findings privately and coordinate public disclosure with us so that we can investigate and address the issue.

The following are not treated as vulnerabilities unless you demonstrate a concrete, practical security impact:

• Email configuration: SPF, DKIM, or DMARC policies, and the ability to send email with a spoofed From header.
• Clickjacking on pages with no sensitive state-changing actions.
• Missing or misconfigured HTTP security headers or cookie flags without a working exploit.
• Output from automated scanners or tools without a verified proof of concept.
• Missing rate limits on non-sensitive endpoints.
• Self-XSS, and cross-site request forgery on logout or other actions with no security impact.
• Content spoofing or text injection, including user-supplied text such as a name that an email client turns into a clickable link.
• Account or email enumeration without a demonstrated attack built on it.
• Business-logic or input-validation gaps that grant no access to data or functionality, such as a client-side check that can be bypassed with no security effect.
• Sessions that remain active after a security setting changes, where the attack requires a session that is already compromised.
• Disclosure of software names or version numbers.
• Issues that require a compromised device, physical access, or an outdated or unsupported browser.
• Vulnerabilities in third-party services that YetOnePro does not control.

YetOnePro does not currently operate a bug bounty program. Submission of a vulnerability report does not create an entitlement to financial compensation. Any reward, if offered, is entirely at YetOnePro's discretion.

We thank the researchers who reported vulnerabilities responsibly and helped make YetOnePro safer.

A report qualifies for the Hall of Fame when all of the following apply:

• It describes a previously unknown vulnerability with a confirmed, practical security impact, such as unauthorized access to other users’ data or accounts.
• It is in scope and the testing followed the rules on this page.
• It is the first report of that issue.
• We confirmed and fixed the issue.

Out-of-scope findings, hardening suggestions, and low-impact issues do not qualify, even when we decide to make a change based on the report. Inclusion is at YetOnePro’s discretion, and we do not add names on request.

• Sardar Zabi, Security Researcher October 2026