---
title: "Vulnerability Disclosure Policy"
description: "How to report a security issue to YouSpot, what is in scope, and what we commit to in return."
canonical: https://youspot.com/security
last-updated: 2026-09-17
---

# YouSpot Vulnerability Disclosure Policy

Updated: September 17, 2026

## Introduction

YouSpot, Inc. ("YouSpot") is committed to keeping the data our members trust us with secure, and we welcome help from security researchers. This policy explains which systems you may test, how to test them responsibly, how to send us a report, what we commit to in return, and how long we ask you to wait before disclosing an issue publicly.

Security research carried out in line with this policy is authorized. We will work with you to understand and fix the problem quickly, and YouSpot will not recommend or pursue legal action against you for research conducted in accordance with it.

## How to Report

Email [andrei@mail.youspot.com](mailto:andrei@mail.youspot.com). Reports may be submitted anonymously. The same contact is published in machine-readable form at [/.well-known/security.txt](https://youspot.com/.well-known/security.txt).

To help us reproduce and fix the issue, please include:

- A description of the vulnerability and the class of issue you believe it is.
- Where you found it: the URL, endpoint, or component.
- The potential impact, as you understand it.
- Steps to reproduce. Scripts, request logs, and screenshots are welcome.

If possible, please write in English.

## Scope

This policy covers the following systems:

- **https://youspot.com**: the YouSpot web application, including the pages served on our other product domains.
- **https://be.youspot.com**: the YouSpot API, including the MCP server it exposes.

Anything not listed above is out of scope, including the third-party services YouSpot is built on (for example Clerk, Supabase, Stripe, Google APIs, Anthropic, and OpenAI). A vulnerability in a third-party product should be reported to that vendor under its own disclosure policy. If you are unsure whether something is in scope, email us before you begin.

## What We Ask of You

- Tell us as soon as possible after you discover a real or potential security issue.
- Give us a reasonable time to fix it before you disclose it publicly. We ask for at least 90 days from our acknowledgment.
- Make every effort to avoid privacy violations, degraded service, disruption to production systems, and destruction or alteration of data.
- Use an exploit only as far as needed to confirm that a vulnerability exists. Do not use it to access or exfiltrate data, to gain command-line access or persistence, or to pivot to other systems.
- If you confirm a vulnerability, or you encounter any sensitive data (personal data, email content, financial information, or proprietary information of any party), stop testing, tell us immediately, and keep the data strictly confidential.
- Test only against accounts you own or have explicit permission to use.
- Do not send a high volume of low-quality reports.

## Testing That Is Not Authorized

- Network or application denial-of-service testing (DoS or DDoS).
- Physical testing (for example office access or tailgating), social engineering (for example phishing or vishing), and any other non-technical testing.
- Testing of third-party services, as described under Scope.

## What You Can Expect from Us

- We acknowledge receipt of a report within three business days.
- We keep you informed as we confirm the issue and work on a fix, to the best of our ability, if you share a way to reach you.
- We will not pursue or recommend legal action for research conducted in accordance with this policy, and we consider such research authorized under the Computer Fraud and Abuse Act and similar laws.
- We welcome a discussion of any concerns, and we are happy to credit you for a report if you would like.

YouSpot does not currently run a paid bug bounty program, and we cannot offer a reward for reports.

## Related Policies

How we handle personal data is described in our [Privacy Policy](https://youspot.com/privacy), and how we treat data obtained from Google APIs is in its Google User Data section. Our use of the service is governed by the [Terms of Use](https://youspot.com/terms).