Report a vulnerability
Found a security flaw in iyedy, its sign-in, its API or these docs? Tell us privately, with what we need to reproduce it.
On this page
If you think you found a security flaw in iyedy, tell us before anyone else. This page says where to write and what to put in the message so that we can reproduce it quickly. It covers app.iyedy.com, auth.iyedy.com, share.iyedy.com, the API and MCP server on app.iyedy.com, iyedy.com and these docs.
Before you test
- Test only with your own account and your own diagrams. Never read, change or delete someone else's data, even to prove a point.
- Do not disturb the service: no denial of service, no automated scanning at a rate that slows it down, no spam.
- Keep it private until we have answered and fixed it.
- Never put a real secret in the message: no password, no live API token. If you must show a token, revoke it first (Create and manage API tokens).
Report it
- Write to the security contact
Write to support@iyedy.com, with a subject that starts with Security. This address is our security contact today.
- Describe what you found
Put in the message:
- What it is, in one sentence, and what an attacker could do with it.
- Where: the address of the page or the API endpoint, and the time you saw it (with your time zone).
- How to reproduce it, step by step, from a new account if you can.
- What you used: browser and version, or the HTTP client and the request, with any token removed.
- Proof, if you have it: a screenshot or a short recording that shows no one else's data.
- Keep the details for us
Keep your notes and the time of each test: we may ask a question to reproduce it. Keep the flaw private while we work on it.
Your report is complete when someone who has never seen the flaw could reproduce it with your steps alone.
Not a vulnerability
Some things are better sent elsewhere:
- You cannot sign in, or your session ends too soon: see Sign-in problems.
- Someone else used your account: end the other sessions and change your password (Secure your account), then write to support.
- A question about how we protect your data: see Your data and How we test security.
If it doesn't work
I sent a report and heard nothing
Check your spam folder for our answer, then write again to support@iyedy.com with the same subject and the date of your first message.
My proof is too large to attach
Describe it in words in the message, and say that you have a recording: we will tell you how to send it.
Was this page helpful?Your answer is anonymous and counts only if you accepted measurement.
What went wrong?
Don't write personal data.