Bug Bounty & Vulnerability Disclosure

Responsible Disclosure Guidelines

To maintain eligibility for our safe harbor and vulnerability acknowledgment program, researchers must:

Avoid Data Destruction: Do not modify or delete other users' uploaded files, database records, or accounts.
No Denial of Service (DoS): Do not execute volumetric Layer 3/4 flood attacks, brute-force spamming, or resource exhaustion attacks.
Prompt Notification: Report findings privately to security@yukiapi.site without public disclosure until a patch is deployed.
Privacy Respect: If you accidentally encounter private files, cease testing immediately and disclose the vulnerability without retaining local copies.

Program Scope & Severity Tiers

Critical (P1)

Remote Code Execution (RCE), Authentication Bypass, Unauthenticated Database Exfiltration.

High (P2)

Stored XSS across download links, Insecure Direct Object References (IDOR), API Key disclosure.

Medium (P3)

CSRF on sensitive endpoints, CORS misconfigurations allowing cross-origin credential theft.

Low (P4)

Subtle rate-limiting bypasses, verbose error traces, non-sensitive metadata leaks.

Submission Template

[Vulnerability Report] Target: https://yukiapi.site Endpoint: /api/upload / /file/{uid} Vulnerability Type: [e.g. IDOR, Stored XSS, SSRF] Severity: [Critical / High / Medium / Low] Steps to Reproduce: 1. ... 2. ... 3. ... Impact: ... Proof of Concept (cURL / Request / Script): ...

Contact Security Team

Send completed reports to security@yukiapi.site or reach out directly to lead architect SUDEEPBOTS on Telegram at @Z0iiw.