Security reporting

If you believe you have found a security issue affecting OhYeh, email hello@ohyeh.io. Include the affected URL, a concise description, reproduction steps, and the potential impact.

Responsible testing

Use only accounts and data that you own or have explicit permission to test.
Do not access, alter, retain, or share another person’s data.
Do not use denial-of-service, automated high-volume testing, social engineering, or physical attacks.
Stop testing and report immediately if you encounter customer data or credentials.
Give us reasonable time to investigate and remediate before public disclosure.

What to expect

We will acknowledge valid reports, investigate them in good faith, and keep you informed when practical. OhYeh does not currently operate a paid bug-bounty programme. This policy does not authorise activity that would otherwise be unlawful.