Security policy

Reporting a vulnerability

Email security@yeswekanban.app. Include reproduction steps, the impact you observed, and any proof-of-concept code or screenshots. Encrypted reports welcome — ask and we'll share a PGP key.

Please don't publicly disclose the issue until we've had a chance to fix it. We'll acknowledge your report within 3 business days and aim to ship a fix within 30 days for critical issues.

What's in scope

• The yeswekanban.app app and API
• The www.yeswekanban.app deployment
• The MCP server at /api/[transport]
• The Stripe webhook and payment surfaces

What's out of scope

• Denial of service / volumetric attacks — please don't test these against production
• Self-XSS or attacks requiring a malicious browser extension installed on the victim
• Missing security headers without a working exploit
• Issues in third-party services (Supabase, Vercel, Stripe) — please report those to the respective vendors
• Social engineering of our team or users
• Physical attacks on infrastructure

What we commit to

• Acknowledge your report within 3 business days
• Provide a regular status update while we're working on a fix
• Credit you in our release notes (with your permission)
• Not take legal action against good-faith research conducted within this policy
• Make a discretionary thank-you payment when your finding leads to a real fix (we don't run a paid bounty program yet — see below)

Safe harbor

If you make a good-faith effort to comply with this policy, we consider your research to be authorized. We won't pursue civil or criminal action against you, and we'll do our best to defend you from any third-party action arising from your participation.

About bounties

We don't run a structured bounty program yet — yeswekanban is a small operation. When your report leads to a fix, we offer a discretionary payment proportional to severity and the effort you put in. As we grow, we'll formalize this and switch to a public program with published ranges.

Coordinated disclosure

Once a fix has shipped to production, we'll work with you on a disclosure timeline. Default: 90 days after the fix deploys, you're free to publish. Ask if you need shorter or longer; we're reasonable.