# Security and vulnerability disclosure

> How to report a security issue to YouSpot, Inc., what is in scope, and what we commit to in return.

YouSpot, Inc. welcomes reports from security researchers. Email **andrei@mail.youspot.com**. Reports may be submitted anonymously.

## In scope

- `https://youspot.com`, the web application.
- `https://be.youspot.com`, the API.

Anything not listed is out of scope, including the third-party services YouSpot integrates with (Clerk, Supabase, Stripe, Google APIs, Anthropic, OpenAI). Report those to the vendor. If you are unsure, ask before you start.

## Not authorized

- Denial-of-service testing, network or application level.
- Physical testing and social engineering, including phishing.

## What we ask

- Tell us as soon as you find something.
- Give us at least 90 days from acknowledgment before publishing.
- Use an exploit only far enough to confirm the issue exists. Do not pivot, persist, or pull data.
- If you reach personal data, stop, tell us, and keep it confidential.

## What to include

- What the vulnerability is.
- Where you found it: the URL or endpoint.
- What an attacker could do with it.
- Steps to reproduce. Scripts and screenshots are welcome.

## What we commit to

We acknowledge a report within three business days, keep you posted through confirmation and remediation, and will not pursue legal action over research conducted in line with this policy.

The full policy is published at `https://youspot.com/.well-known/security.txt`.