Vulnerability Disclosure Policy

1. Reporting a vulnerability

If you believe you have found a security vulnerability in YLOAD 360, email security@fracht.ro. Please include what you found, the steps to reproduce it, the address of the affected page or endpoint, and how we can reach you. Reports in English or Romanian are welcome. The same contact is published in /.well-known/security.txt.

2. What we commit to

• We aim to acknowledge your report within 5 business days.
• We will tell you whether we could reproduce the issue and keep you informed while we fix it.
• We will agree a disclosure date with you once a fix is available, and credit you if you wish.
• We do not run a paid bug bounty programme.

3. Scope

In scope: the YLOAD 360 web application and its APIs on yload.eu hosts. Out of scope: denial-of-service testing, social engineering, physical attacks, spam, and findings in third-party services we use — please report those to the provider concerned.

4. Testing in good faith

• Use only accounts you own or have permission to use, and never access, change or delete data that is not yours.
• If you reach personal or customer data, stop, do not keep a copy, and tell us what you saw.
• Do not degrade the service for other users; avoid automated scanning at volume.
• Give us a reasonable time to fix the issue before you disclose it — normally up to 90 days.

If you follow this policy, we will consider your research authorised, we will not pursue legal action against you for it, and we will not ask anyone else to.