Vulnerability Disclosure Policy

Last updated: 6 November 2026

We write about other people’s security holes most weeks, so we should make it easy to report ours. If you have found a security problem in youngstercompany.com or in one of our free tools, this page says what we would like you to do, what we promise in return, and where the limits are. Thank you for taking the time.

1. What is in scope

2. What is out of scope

  • Services we use but do not run: Razorpay (payments), Hostinger (hosting and CDN), Buffer, Google (Analytics, Search Console, AdSense), Jetpack and WordPress.com, our email providers and our social media accounts. Please report problems in those to the vendor.
  • Anything that needs physical access to our devices, a stolen device, or one of our accounts that was compromised some other way.
  • Reports we will close without action: output from automated scanners with no demonstrated impact; software version numbers on their own; a missing header or best-practice setting that does not lead to an exploitable issue; clickjacking on pages where nothing changes state; rate limiting on public forms; our SPF, DKIM and DMARC records (we publish them and check them every week); self-XSS; problems that only appear in an outdated browser; files that are public on purpose, such as robots.txt, the sitemaps and security.txt.

3. Rules for testing

  • Test with your own accounts and your own data. Do not read, change or delete data that is not yours. If you reach someone else’s data by accident, stop, do not keep a copy, and tell us.
  • No denial of service, no load testing, no password guessing against our logins, and no spam through our forms.
  • No social engineering of our team, no phishing, and no attempts in person.
  • Keep automated scanning light. Our host throttles aggressive traffic, and that slows the site for visitors.
  • Stop at proof. A screenshot or a minimal demonstration is enough. Do not go further into the system, and do not leave anything behind.
  • Give us time to fix the problem before you talk about it publicly (see section 6).

4. How to report

Email contact@youngstercompany.com with “Security report” in the subject line, or use the contact form. Please include the URL or component, the steps to reproduce the problem, what you expected and what happened instead, how serious you think it is, any tool you used, and the name or handle you want credited (if you want credit).

We do not offer encrypted email yet. If your report contains something sensitive, say so in a first short email and we will arrange a channel.

5. What we promise

  • We will confirm that we received your report within 3 business days and tell you what we think of it within 7.
  • We aim to fix critical issues within 7 days, high within 30 and the rest within 90. We are a small team; if a fix takes longer we will tell you why.
  • We will keep you informed until the issue is closed and credit you on this page once the fix is live, if you want that.
  • We will not take legal action against you, or report you to the police, for research that follows this policy. If a third party raises the matter, we will state that you acted with our permission. Unauthorised access is an offence under sections 43 and 66 of the Information Technology Act, 2000; this policy is our written authorisation for in-scope testing within these rules.
  • We do not pay bounties at the moment. We credit researchers here, and for a serious finding we will send you one of our toolkits for free.

6. Public disclosure

We prefer coordinated disclosure. Please wait until the fix is live or 90 days after your report, whichever comes first, before you publish details. We will publish our own note about any fix that affected users or customers.

7. Hall of thanks

No reports yet. Yours could be the first.

8. How we check ourselves

We run a passive security audit of this website every Sunday and publish the result of our own website safety check. The current grade is at youngstercompany.com/check/youngstercompany.com/. Our machine-readable contact details are in security.txt.