heyyoink
Security & vulnerability disclosure
Hey Yoink's entire product promise rests on one guarantee: a list owner can never see who claimed what. That's enforced at the server level, not just hidden in the interface. If you believe you've found a way around that - or any other security issue - we want to hear about it.
Scope
This policy covers the Hey Yoink web application and its API - every route under this domain, including owner dashboards, guest list pages, and the /api/* and /out/* endpoints.
How to report
Email hey@heyyoink.com with a description of the issue, steps to reproduce, and its potential impact. Please don't test against real users' lists or data beyond what's needed to demonstrate the issue, and don't publicly disclose a report until it's been acknowledged and addressed.
What to expect
We'll acknowledge reports within 3 business days. This is a small, independently-run product - there's no paid bounty program at this stage, but genuine, responsibly-disclosed reports are taken seriously and credited if you'd like.
Safe harbor
We won't pursue legal action against anyone who makes a good-faith effort to follow this policy: testing only against your own lists/data, avoiding privacy violations or service disruption for other users, and reporting privately before any public disclosure.
Particularly interested in
Anything that would let an owner see claim status, anything that lets a guest token be guessed or enumerated, or any way to make an owner's or guest's data visible to someone it shouldn't be - these strike at the core trust mechanic of the product and are the highest priority.