YouSpot security and vulnerability disclosure
How to report a security issue to YouSpot, Inc., what is in scope, and what we commit to in return. A summary of the policy published at /security.
YouSpot, Inc. welcomes reports from security researchers. Email andrei@mail.youspot.com. Reports may be submitted anonymously.
In scope
https://youspot.com, the web application.https://be.youspot.com, the API.
Anything not listed is out of scope, including the third-party services YouSpot integrates with (Clerk, Supabase, Stripe, Google APIs, Anthropic, OpenAI). Report those to the vendor. If you are unsure, ask before you start.
What we ask
- Tell us as soon as you find something.
- Give us at least 90 days from acknowledgment before publishing.
- Use an exploit only far enough to confirm the issue exists. Do not pivot, persist, or pull data.
- If you reach personal data, stop, tell us, and keep it confidential.
What to include
- What the vulnerability is.
- Where you found it: the URL or endpoint.
- What an attacker could do with it.
- Steps to reproduce. Scripts and screenshots are welcome.
What we commit to
We acknowledge a report within three business days, keep you posted through confirmation and remediation, and will not pursue legal action over research conducted in line with this policy.
The full Vulnerability Disclosure Policy is published at youspot.com/security; the machine-readable contact is https://youspot.com/.well-known/security.txt.