Security
Reporting a security issue
If you have found a vulnerability in this website, email security@yycore.ai rather than opening a public issue. For yy-corpus-evidence, use the repository's private reporting channel described below.
What to include
A report we can reproduce is worth far more than a scanner screenshot. Where you can, please tell us:
Where it is
The affected URL, package version, file, or endpoint, and the environment you were using.
How to reproduce it
The concrete steps, request, or minimal input that triggers the behaviour, including anything non-obvious about your setup.
What it lets someone do
Your read on the impact, and how confident you are in it. A plausible worst case stated as a worst case is fine; a certainty you have not verified is not.
How you would like to be credited
Tell us if you want acknowledgement and under what name, or if you would rather stay anonymous.
Scope
In scope:
- This website,
yycore.ai, and the files it serves. - The yy-corpus-evidence library and its published package, including issues in how it reads local files or produces and verifies its artifacts. Submit these through the private GitHub report form.
Out of scope:
- Findings that depend on a compromised device, a malicious browser extension, or physical access to a machine that is already controlled by an attacker.
- Reports about missing hardening headers or configuration preferences with no demonstrated impact, and automated scanner output submitted without analysis.
- Social engineering of anyone at YY, and testing that targets third-party services we merely link to.
Good-faith research
We welcome good-faith security research and will work with anyone who reports an issue responsibly. Research is good faith when it avoids harm: do not access, modify, or destroy data that is not yours; do not degrade or disrupt the service for other people; do not run high-volume automated testing against this site; and use only the minimum access needed to demonstrate the problem.
Please give us a reasonable opportunity to investigate and fix an issue before disclosing it publicly, and we will keep you informed while we do. We do not run a paid bug bounty programme.
How this site is built
Context that may save you time, and that we hold ourselves to.
- Static content, no user dataThe site is server-rendered text and local assets. There are no accounts, sessions, forms, uploads, or payments, so there is no visitor database to breach.
- No cookies, analytics, or third-party codeNothing on these pages loads scripts, fonts, or trackers from other origins. See our privacy page for the detail.
- Local-first softwareyy-corpus-evidence operates on files you already have, on a machine you already control, and does not upload corpus contents.
- Published formatsThe manifest-output and declaration-input formats are described by JSON Schemas served from this domain, so their structure can be reviewed independently of our code.
Contact
- Security
- security@yycore.ai
- Legal notices
- notices@yycore.ai
- Privacy
- privacy@yycore.ai