Vulnerability disclosure policy

We welcome reports from security researchers. If you believe you have found a vulnerability in YOM, please tell us privately so we can fix it before it is exploited. This policy is also published in machine-readable form at /.well-known/security.txt.

1. How to report

Email contact@aapastech.com with “Security report” in the subject. Please include the affected URL or component, a description of the issue and its impact, steps to reproduce, and any proof-of-concept. Use test accounts you created yourself. If the report contains sensitive detail, say so and we will arrange a secure channel.

2. Scope

In scope:

• yom.aapastech.com (this website and the YOM dashboard)
• *.yourownmetrics.aapastech.com (API, ingest, MCP and connector endpoints)
• The YOM SDK (@yourownmetric/sdk) and embed component (@yourownmetric/embed)

Out of scope:

• Other customers’ accounts, data, portals or custom domains.
• Denial-of-service, load or stress testing, and volumetric attacks.
• Social engineering, phishing, or physical attacks against our staff or providers.
• The infrastructure of our providers (report those to the provider).
• Findings without a demonstrated security impact, such as missing headers on static pages, clickjacking on pages with no sensitive actions, self-XSS, rate-limit observations without abuse impact, or reports from automated scanners alone.

3. Rules of engagement

• Only test against accounts and data you own. Stop and tell us as soon as you reach data that isn’t yours, and do not keep, copy or share it.
• Do not degrade the service or disrupt other users. Keep automated testing to a gentle rate.
• Do not use a vulnerability beyond what is needed to show it exists.
• Give us a reasonable time to fix the issue (normally 90 days) before any public disclosure, and coordinate the disclosure with us.
• Comply with all applicable laws.

4. Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, will not pursue or support legal action against you for it, and will work with you to understand and resolve the issue. If a third party takes legal action against you for research that followed this policy, we will make it known that your actions were authorised. This safe harbour does not cover activity that breaks the rules above or the law.

5. What we commit to

• Acknowledge your report within 5 business days.
• Keep you informed while we investigate and fix it.
• Credit you publicly when the fix ships, if you want to be credited.

We do not run a paid bug-bounty programme at this time.