Security Policy

Last updated 17 October 2026

We take the security of YourImageShare and the people who use it seriously. If you have found a security vulnerability, thank you for telling us. This page explains how to report it, what you can expect from us, and the rules for testing safely.

1. How to report a vulnerability

Email [email protected], or use the contact form and start the subject with "Security". Please do not report vulnerabilities in public places (GitHub issues, comments, social media) before they are fixed.

Please include:

  • a description of the problem and what an attacker could do with it;
  • the exact steps, URLs and requests needed to reproduce it (a proof of concept is welcome);
  • the part that is affected: website page, API endpoint, browser extension, WordPress plugin, SDK, bot;
  • how you would like to be credited, if at all.

Our machine-readable contact details are in /.well-known/security.txt.

2. What you can expect from us

  • Acknowledgement within 5 business days.
  • First assessment (whether we can reproduce it and how serious it is) within 10 business days.
  • A fix or a status update within 90 days. Serious issues are fixed as fast as we can, usually much sooner.
  • Coordinated disclosure. Please wait until the issue is fixed, or until 90 days have passed, before you publish details. We are happy to agree a date with you.

We are a small team. We will keep you informed and will not ignore a valid report.

3. Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised. We will not take legal action against you or report you to law enforcement for it, and we will not ban your account because of it. If a third party takes legal action against you for research that followed this policy, we will make it known that your work was authorised.

Good faith means that you:

  • test only with your own accounts and your own uploads, or with accounts you have permission to use;
  • stop as soon as you reach other people's data (uploads, account details, messages), do not keep or share it, and tell us what you accessed;
  • do not degrade the service for others (no denial-of-service, no high-volume automated scanning, no spam);
  • do not use social engineering, phishing or physical attacks against our staff, users or providers;
  • give us reasonable time to fix the issue before disclosing it;
  • never upload illegal content, including child sexual abuse material, for any reason.

If you are unsure whether something is allowed, ask us first at [email protected].

4. In scope

  • yourimageshare.com and its subdomains (for example i.yourimageshare.com and status.yourimageshare.com);
  • the public upload API, its documentation and our official SDKs and MCP server;
  • our browser extensions, WordPress plugin and Telegram bot.

Examples of what we want to hear about: account takeover, authentication or authorisation bypass, access to other people's private or password-protected uploads, cross-site scripting that affects other users, cross-site request forgery on actions that change data, server-side request forgery, injection, remote code execution, and problems in how uploaded files are processed.

5. Out of scope

These are not treated as vulnerabilities unless you can show a real impact on users:

  • missing or "best practice" HTTP headers, cookie flags or TLS settings without a working attack;
  • SPF, DKIM or DMARC configuration reports;
  • clickjacking on pages without sensitive actions;
  • self-XSS, or attacks that need full access to the victim's device or browser;
  • rate limits on public pages, and username or email enumeration through public profiles;
  • reports from automated scanners without a confirmed, reproducible issue;
  • denial-of-service attacks.

6. Illegal or abusive content is not a security report

To report an upload that is illegal, abusive or breaks our Terms and Conditions, use the Report button on the item or our report form. These reports are handled by our moderation team, not through the security address.

7. Rewards and credit

We do not run a paid bug bounty. With your permission, we will thank you by name (or handle) in the acknowledgements below and in the release notes of the fix.

8. Acknowledgements

We thank the following people for responsibly reporting security issues:

  • No reports credited yet.