Responsible Disclosure Policy

At CAP we take the security of YAJU AS and of our websites seriously. Despite our efforts, vulnerabilities can exist. If you find one, please tell us privately so we can fix it before anyone misuses it. This policy explains how to report a vulnerability, what you can expect from us, and the rules you must follow while doing security research.

Scope

This policy covers:

• The YAJU AS Platform.
• Our websites, yajuas.com and capconsultor.eu.

How to report

Email contact@capconsultor.eu with the subject "Security report" and include:

• What the vulnerability is and where you found it.
• Steps to reproduce it.
• The possible impact.

A clear and complete report helps us understand and fix the problem faster. If you can, write the report in English or Spanish, and include any screenshots or technical details that help us reproduce the issue.

What we do

• We reply within 5 business days.
• We keep you informed while we investigate and fix it.
• With your permission, we thank you publicly once it is fixed.

We do not have a paid bug bounty program.

Rules

• Test only with your own accounts and data.
• Do not access, change or delete other users' data. If you reach it by accident, stop and tell us.
• Do not use any credentials or API keys you find.
• No denial-of-service attacks, spam, social engineering or physical attacks.
• Do not use automated tools in a way that affects the normal operation of the Platform or the websites.
• Keep the vulnerability confidential until we fix it, or for 90 days after your report, whichever comes first.

Out of scope

• Vulnerabilities in third-party services we use or you connect (AI providers, Neon, Vercel, Cloudflare, AWS, Stripe, Google, GitHub). Report them to those companies.
• Findings with no real security impact.

Good faith

If you follow this policy in good faith, we will not take legal action against you for your research. If you are unsure whether an action is allowed by this policy, ask us first at contact@capconsultor.eu.