Report Security Issues
Found a vulnerability on yardcrafttools.com? Help us keep our customers safe. Here’s how to report it responsibly — and how our bounty program rewards you.
Please don’t: run denial-of-service tests, access other customers’ data, or publicly disclose an issue before we’ve had a reasonable chance to fix it.
If you’ve found a security vulnerability on yardcrafttools.com, we want to hear about it. We review every legitimate report and work to fix confirmed issues quickly. Before reporting, please read this page — including our fundamentals, bounty program, reward guidelines, and out-of-scope issues.
Fundamentals (Safe Harbor)
If you follow the principles below when researching and reporting a security issue, we will not pursue legal action or ask law enforcement to investigate you in response to your good-faith report. We ask that you:
- Give us reasonable time to investigate and fix the issue before disclosing it publicly or sharing it with others.
- Do not access or interact with accounts or data that aren’t yours without the owner’s consent — use test accounts where possible.
- Make a good-faith effort to avoid privacy violations, service disruption, and data destruction.
- Do not exploit the issue beyond what is needed to confirm it, including to access sensitive data or demonstrate further risk.
- Comply with all applicable laws.
How to Report
Email your report to [email protected] with the subject line “Security Vulnerability Report – yardcrafttools.com”. Please send reports only through this channel rather than contacting individual team members. Include a clear description, step-by-step reproduction, the potential impact, and any screenshots, video, or proof-of-concept code. Reports we can’t reproduce aren’t eligible for a bounty. We’ll acknowledge your report within 3 business days and keep you updated until it’s resolved.
Email a Security ReportBounty Program
We recognize and reward researchers who help keep yardcrafttools.com safe. Bounties are awarded at YardCraft Tools LLC’s discretion based on risk, impact, and report quality. To qualify, you must:
- Follow the Fundamentals above.
- Report a valid, reproducible vulnerability that poses a real risk to privacy or security.
- Submit your report by email as described in Section 02.
- Tell us about any accidental privacy violation or disruption that happened during testing.
- Understand that we prioritize reports by risk, so a response may take some time.
- Agree that we may publish reports after the issue has been fixed.
Rewards
Rewards are based on impact, exploitability, and report quality. The first valid report of an issue receives the bounty, and multiple bugs caused by a single underlying issue are treated as one report. Current maximum rewards by severity:
- Remote code execution
- Remote shell or command execution
- Vertical authentication bypass
- SQL injection that leaks targeted data
- Full account takeover
- Lateral authentication bypass
- Disclosure of sensitive internal data
- Stored XSS affecting other users
- Local file inclusion
- Insecure handling of authentication cookies
- Logic or business-process flaws
- Insecure direct object references
- CSRF on sensitive actions
- Unvalidated redirects in sensitive flows (e.g. login or checkout)
- Low-impact open redirects
- Reflected XSS
- Low-sensitivity information leaks
- Missing security headers
Out of Scope
The following are not eligible for a bounty:
Denial-of-service (DoS/DDoS) attacks or testing
Spam or social engineering attacks
Physical security issues
Vulnerabilities in third-party services or plugins not directly controlled by YardCraft Tools LLC — please report these to the vendor
Reports generated only by automated scanning tools, without manual validation
Issues already known to our team or previously reported
Contact Information
Security reports and questions about this policy can be sent to YardCraft Tools LLC:
Security Reporting FAQ
Email [email protected] with the subject “Security Vulnerability Report – yardcrafttools.com”, including the affected URL, steps to reproduce, impact, and any proof of concept.
No — if you follow our Fundamentals in good faith, we will not pursue legal action or ask law enforcement to investigate you because of your report.
Up to $200 for critical, $100 for high, and $50 for medium severity issues. Low-severity reports receive recognition. Final amounts depend on impact and report quality.
DoS attacks, social engineering, third-party service vulnerabilities, missing headers, self-XSS, and issues we can’t reproduce.
We acknowledge every report within 3 business days and keep you informed until the issue is resolved.
Only the first valid report of an issue receives the bounty.