Found a vulnerability? Tell us first.

Scope

• yaatasaheel.com and all its pages.
• The product demos under /demo/.

Out of scope: services owned by third parties (such as our host, Formspree or social platforms), and our clients’ systems.

How to report

Email info@yaatasaheel.com with a subject starting “Security disclosure”, including:

• A description of the issue and its likely impact.
• The affected URL or component.
• Steps to reproduce, with screenshots or a minimal proof of concept.
• How we can reach you.

Contact details are also in /.well-known/security.txt.

What we commit to

• Acknowledging your report within 3 business days.
• An initial assessment and next steps within 10 business days.
• Letting you know when the issue is fixed.
• No legal action against good-faith research that follows these rules.
• Public thanks, if you would like it.

Rules of engagement

• No denial of service, load or flood testing.
• No social engineering, phishing or physical testing.
• Do not access, change or delete other people’s data; stop at the smallest possible proof.
• No heavy automated scanning that affects performance.
• Give us reasonable time (90 days) before any public disclosure.

Not considered vulnerabilities

• Missing best practices with no exploitable impact.
• Clickjacking on pages with no sensitive actions.
• SPF or DMARC settings on their own.
• Form spam with no security impact.
• Issues that need a compromised device or an outdated, unsupported browser.

Rewards

We do not run a paid bounty programme at the moment, but we value every serious report and thank its author.