Report a vulnerability
If you think you have found a security problem in yclas.com or in a site we host, email info@yclas.com with "Security report" in the subject. Please include:
- the address of the page or feature affected;
- the steps to reproduce the problem, and what an attacker could do with it;
- how we can contact you.
We answer every report within 3 business days, keep you informed while we work on it, and tell you when it is fixed. Please give us a reasonable time to fix a problem before you make it public.
While testing, please don't access, change or delete other people's data, don't degrade the service for others (no denial-of-service or high-volume automated scans), and use only accounts and sites you own. Problems on a customer's own content, like scripts its owner added, are theirs to fix: we will pass your report on.
Machine-readable contact details are in security.txt.
How we protect sites
- HTTPS. yclas.com and every site on a yclas.com address tell browsers to use HTTPS only (HSTS).
- Firewall. yclas.com and sites on yclas.com addresses are behind Cloudflare, with firewall rules against attacks and abusive bots.
- Security headers. Pages tell browsers not to let other websites frame them, not to run plugins, and not to send full addresses to other sites.
- 2-step sign-in. Your Yclas account and your site's admin panel both support 2-step verification.
- Audit log. Your site's admin panel keeps a log of what your team changes: settings (with secrets masked), roles and permissions, deleted users and listings, and refunds. Every time our support team signs in to your site, that is logged too.
- Backups. Every active site's database is backed up every hour, and the backups are kept for seven days.
- Card payments. Card details for your Yclas plan are typed into fields hosted by Stripe: card numbers never reach our servers.
- Updates. We host and update the software for every site, so security fixes reach all sites at once, with nothing for owners to install.
Questions
For questions about security that aren't a vulnerability report, like a security questionnaire for your organization, email info@yclas.com.