Vulnerability disclosure policy
Version 1.0 · Published 30 August 2026 · The machine-readable summary of this page is at /.well-known/security.txt.
Before you start: Yesterself has not shipped yet, so there is no App Store build and no production sync server to test against. The design is testable now, and design flaws are the most valuable reports we can receive — the protocol and the threat model are in scope from today.
Send reports to hello@khreshitech.solutions. That address is monitored today. It replaced security@yesterself.app on 31 August 2026, when yesterself.khreshitech.solutions became Yesterself's permanent home rather than an interim one — the old mailbox never delivered, because that domain was never registered.
The promise
If you report a security issue in good faith, we will not sue you, will not report you, and will not ask your ISP or employer about you. We will answer.
What we commit to
| Item | Commitment |
|---|---|
| Contact | hello@khreshitech.solutions; or a private GitHub Security Advisory on the yesterself/yesterself-server repository. We do not yet offer PGP. There is no key and /pgp.txt does not exist; this row used to point at one, which is worse than offering nothing, because it asks you to encrypt to something you cannot fetch. The offer comes back — here and as the Encryption field of security.txt — on the day the key does. Until then, if a report is too sensitive to send in clear, open a private GitHub Security Advisory instead. |
| Acknowledgement | Within 72 hours. |
| Triage and severity decision | Within 7 days, with our reasoning. |
| Fix targets | SEV-1 (key material, plaintext exposure): patch or mitigation within 7 days. SEV-2: 30 days. SEV-3: 90 days. SEV-4: next routine release. |
| Coordinated disclosure | 90 days from the report, or on the day a fix ships, whichever is first. If we need longer we will say so, with a date and a reason, before day 90 — not on day 89. |
| Credit | Named in the advisory and in SECURITY.md unless you prefer otherwise. |
| Reward | No cash bounty at launch — a solo-funded product cannot honor one predictably, and an unpayable bounty is worse than none. Instead: a Founder Lifetime license for any accepted SEV-1/SEV-2 report, public credit, and a written thank-you. We will revisit a paid program when revenue supports it. |
| Safe harbor | Testing that stays within scope, uses only accounts you control, avoids privacy violations and service degradation, and does not exfiltrate or retain other people's data is authorized. We consider it authorized under CFAA-equivalent statutes and will say so in writing if asked. |
In scope
The iOS and Android apps; sync.yesterself.khreshitech.solutions and the yesterselfd source; the steward claim page; yesterself.khreshitech.solutions and its subdomains; and the sync/crypto protocol design itself — design flaws are the most valuable reports we can receive.
Out of scope
Denial-of-service and volumetric testing; social engineering of the developer, users, Apple, Google, or Hetzner; physical attacks; findings that require a rooted or jailbroken device, a malicious OS, or a debugger attached to your own process; missing security headers with no demonstrated impact; self-XSS; outdated-library reports without a reachable path; rate-limit tuning opinions; email SPF/DMARC on a domain that sends no mail (that is deliberate); and reports generated solely by an automated scanner with no analysis.
Please do not
Test against accounts that are not yours; upload real other-people data; or run anything that would delete or degrade the service for a paying user. If you accidentally access data that is not yours, stop, tell us, and delete it — we will treat that as good faith.
What a report can and cannot reach
Two facts are worth stating up front, because they shape what is worth your time. Our server holds ciphertext and mechanical metadata and no key capable of decrypting anything — so the worst server-side bug still cannot read a journal. And the design does not claim tamper-proofness against the server, only tamper-evidence: a malicious or compelled server can withhold or delay, and we say so in the privacy policy rather than implying otherwise. A report that demonstrates something stronger than either of those statements is exactly the report we most want.
Acknowledgements
No reports have been received yet. This section exists, empty, so that the anchor in security.txt resolves to a page rather than a 404 — everyone credited here will be credited by name unless they ask otherwise.
Related: the privacy policy and its threat statements, and /.well-known/security.txt.