Security and Vulnerability Disclosure Policy
This policy is issued by Ydentifi Ltd., a company registered in the Republic of Bulgaria under number 208962261, with its registered office at Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad ("Ydentifi").
This page tells you how to report a security weakness in Ydentifi, what we promise in return, and what we ask of you.
Safe harbour
If you follow this policy, we will not bring or support legal action against you for the research that found the problem. The same commitment appears in the End User License Agreement for the app.
We will not ask your hosting provider or employer to act against you, and we will not report you to law enforcement, for research conducted in line with this policy.
If you are unsure whether something you plan to do falls inside the policy, ask us first.
How to report
Write to security@ydentifi.io. If you would like to encrypt the report, ask at the same address for our public key.
Please include enough for us to reproduce the problem: what you did, what happened, what you expected, and the version or deployment you were testing. A proof of concept helps. If you have a preferred name for credit, tell us.
Do not open a public issue, post about it, or contact us through social media. Use the address above, even if the problem looks minor.
What we commit to
- Acknowledge your report within 3 working days, from a human
- Assess and confirm or dismiss it within 10 working days, with our reasoning either way
- Keep you updated while we work, without you having to chase
- Agree a disclosure date with you, rather than imposing one
- Credit you when we publish, unless you would rather we did not
If we conclude something is not a vulnerability, we will tell you why. You are free to disagree publicly; we would ask that you say what our reasoning was.
Coordinated disclosure
We ask that you give us 90 days from your report before publishing, or until a fix is available, whichever comes first.
If a problem is being actively exploited, that timeline compresses for both of us and we will say so. If we are taking too long, tell us.
What we ask you not to do
- Access, modify or delete data belonging to anyone else. If you find you can, stop and tell us
rather than proving how far it goes
- Degrade the service for other people — no denial of service, no load testing against systems you
do not own
- Use social engineering against our people, our customers or their users
- Attempt physical access to anything
- Act unlawfully
Scope
In scope: the Ydentifi server software, the mobile applications, the published SDKs, and the protocol itself — including cryptographic weaknesses, authentication bypasses, and anything that lets one tenant reach another's data.
Not in scope: deployments operated by our customers. Ydentifi is self-hosted, so most running systems belong to somebody else. Do not test a deployment you do not own — report the weakness to us and we will handle it with the operator. Also out of scope: our marketing website's third-party services, and reports generated solely by automated scanners without a demonstrated impact.
Systems Ydentifi operates are in scope: the demo at https://ydentifi.io/demo and demo.ydentifi.io, and the licensing service at licensing.ydentifi.io. On those systems:
- Test only walkthroughs you started, and only the demo accounts they created
- Do not exhaust the demo's walkthrough capacity or its limit on new walkthroughs. That degrades
the service for other people
- Keep automated requests to a low rate
- If you reach another visitor's walkthrough or another customer's licence records, stop and tell us
If you operate a Ydentifi deployment
Report to us on the same terms. Your agreement with us also sets out notification timelines, and nothing in this policy or that agreement restricts you from making any disclosure required by law or by your own regulator, or from warning your own users.
Contact
security@ydentifi.io