Security disclosure policy

If you have found a security problem in anything WYTOR runs, we want to hear about it, and we will treat you as a colleague rather than a threat.

Scope

This site (wytor.ai and its subdomains) and the WYTOR ventures listed on the register: their websites, apps and APIs. Third-party services we use (app stores, Cloudflare, payment providers) are out of scope here; report to them directly.

How to report

• Email security@wytor.ai, or use the contact form with the security reason selected.
• Machine-readable contact details are at /.well-known/security.txt.
• Include what you found, how to reproduce it, the impact as you understand it, and how you would like to be credited, if at all.

What we ask

• Make a good-faith effort not to access, change or destroy other people's data. If you reach it, stop and tell us.
• No denial-of-service, no social engineering of people, no physical attacks.
• Give us a reasonable time to fix the problem before you publish, and do not publish other people's data.

What we promise

• We acknowledge your report within three working days and tell you what we found.
• We keep you informed as we fix it, and we tell you when it is fixed.
• We credit you, here or in the product's release notes, if you want it.
• We will not take legal action against research done in good faith under this policy.

Rewards

WYTOR does not run a paid bug bounty programme today. We say so rather than imply one.