Security policy

Report a vulnerability

If you find a security problem in vybebat.dev, email hello@vybebat.dev with the subject "Security report". Please include what you found, where, the steps to reproduce it and what an attacker could do with it. Our security.txt lists the same contact.

We read every report, confirm when we have it, keep you informed while we fix it, and credit you if you wish. We do not run a paid bug bounty.

Rules for testing

In scope: vybebat.dev and www.vybebat.dev.

Please do not access, change or delete data that is not yours; use only accounts you own. Do not run denial-of-service tests, high-volume automated scanning, spam, social engineering or physical attacks. Stop as soon as you have shown the problem, and do not keep any data you came across.

Give us a reasonable time to fix the issue before you publish it, normally 90 days.

Good-faith research

If you follow these rules and act in good faith, we will not take legal action against you or report you to the authorities for your research, and we will treat your report as an authorised effort to help us. This covers only systems we own and cannot bind third parties.

How we protect the site

All traffic is encrypted (HTTPS only, with HSTS). Every page is sent with a strict content security policy and headers that block framing, content sniffing and cross-site requests.

Sign-in links, sessions and passwords are stored only as hashes. Session cookies are HttpOnly, Secure and SameSite. Sign-in forms give the same answer for every email address, attempts are rate limited, and password sign-in pauses after repeated failures. Every request to change data must come from this site.

Logs contain no IP addresses, email addresses or request URLs. Admin changes to accounts are recorded on the account. Client app builds are never uploaded to this website, to online scanners or to AI services.

Contact

Harith Al-Ani, trading as vybebat, Max-Schwarze-Weg 27a, 46236 Bottrop, Germany. Email: hello@vybebat.dev.