Security policy

This is the practice’s own disclosure policy. It is short on purpose: a policy nobody can act on is decoration. The machine-readable contact for the same thing is /.well-known/security.txt (RFC 9116), and the two are kept in step.

Reporting

Email yannick@ymrtech.com with the subject line security. If you want an encrypted channel, say so in a plain first message and a key can be arranged — no PGP key is published for this address, so none is claimed.

Please include what you touched, how to reproduce it, and what you think the impact is. A proof of concept is welcome; a scanner’s raw output is not a report.

In scope

• ymrtech.com and its subdomains — the site, the client portal, the subscription and payment flow, and the public VPN endpoints.
• The fleet’s own infrastructure, to the extent a report concerns how the service treats client data.

Out of scope

• Denial of service, volumetric or resource-exhaustion testing.
• Spam and social engineering against the practice or its clients.
• Reports produced only by an automated scanner, with no demonstrated impact.
• Anything requiring access to another client’s account or device.

What to expect

• Acknowledgement within 3 business days.
• An assessment — in scope or not, and why — within 10 business days.
• A fix timeline once the assessment lands, and a note when it ships if you want one. Credit is offered, never assumed; say whether you want your name on it.

Safe harbour

If you stay within the scope above, act in good faith, do not exfiltrate data belonging to anyone else, and give a reasonable window to fix what you find, this practice will not pursue legal action and will say so in writing if asked.

Related

• About this site’s API — the public HTTP surface, and what is deliberately not public.
• Standards — the engineering standards the site and the fleet are held to.