Report in good faith, we're good.
If you research our systems in good faith — avoid privacy violations, data destruction, and service interruption — we will not pursue legal action or report you to law enforcement. We'll work with you to understand and remediate the issue, and we'll credit you if you'd like (or keep you anonymous if you'd prefer).
Report to security@yegg.io with a description, reproduction steps, and impact. Encrypted mail preferred — key material below.
What's fair game.
In scope: yegg.io and subdomains, our client-facing applications, and publicly exposed infrastructure we operate.
Out of scope: our clients' systems (get their authorization — that's the whole business), social engineering of our staff, physical access, and third-party services we don't control.
Please: use test accounts where possible, don't access other users' data, and give us reasonable time to fix before public disclosure. If a finding touches client data, stop and report immediately — we'll take it from there.
Reach us safely.
Email: security@yegg.io · Policy file: security.txt (deploy to /.well-known/ on our domain)
# reporting key (placeholder — rotate before launch) fingerprint: 7EGG 0FF3 N51V E53C UR1T Y7EA M000 0000 0000 0000 keyserver: keys.openpgp.org expires: rotates annually — verify fingerprint against this page
This policy is a starting framework and should receive legal review before launch.