Security and vulnerability disclosure

Reporting

Email support-yuhina@magpie.sa with what the issue is, how to reproduce it, and the account you tested with. Machine-readable version: /.well-known/security.txt (RFC 9116).

What we do

We acknowledge within five working days, keep you updated, credit you when it is fixed if you want, and tell affected users and the relevant authority if their data was exposed. There is no bug bounty.

Safe harbour

If you research in good faith and follow this page, we will not take or support legal action against you, and we treat your research as authorised. Unsure whether something is in scope? Ask first at support-yuhina@magpie.sa.

Rules

• Test only accounts you created. Stop once you have confirmed an issue, and do not access, keep or change anyone else's data.
• No denial-of-service or load testing, no spam or high-volume scanning, no social engineering or physical attacks.
• Do not publish an issue until it is fixed or 90 days have passed, whichever comes first.

Scope

In scope: the YUHINA app and its API, the generation service, and the marketing website. Out of scope: our providers' own systems (report to them), automated-scanner output with no working proof, and missing best-practice headers with no shown impact.