Vulnerability Disclosure Policy

1. OVERVIEW

At YWO (Pty) Ltd (“YWO”, “we”, “our”), safeguarding the integrity of our systems and the security of our clients’ data is a top priority. We welcome responsible security research and we are committed to working collaboratively with the cybersecurity community to identify and resolve any legitimate vulnerabilities in a manner that protects both parties and our users.

This Vulnerability Disclosure Policy (the “Policy”) outlines the terms under which security researchers may report vulnerabilities to YWO, how these reports should be submitted, and what systems and types of vulnerabilities are in scope.

By participating in this process, you acknowledge that you have read, understood, and agreed to the conditions set forth herein.

2. GUIDLINE PRINCIPLES

2.1. Safe Harbour

YWO commits not to pursue legal action against individuals who:

• Conduct vulnerability research in good faith,
• Follow the rules outlined in this policy, and
• Avoid harming YWO systems, data, or users.

If a third party initiates legal proceedings against you for activities conducted in accordance with this Policy, YWO will confirm to the third party that your actions were permitted under this Policy.

The Safe Harbour provided by YWO does not extend to the actions or rights of unrelated third parties and does not authorise unlawful activity.

If you are unsure whether your actions comply with this policy, please pause and contact us first via the official communication channel.

2.2. Responsible Conduct Guidelines

You may engage in security research only if you agree to the following principles:

Required Conduct

Researchers must:

• Report vulnerabilities to YWO as soon as they are discovered.
• Avoid any actions that compromise privacy, disrupt services, manipulate data, or degrade user experience.
• Limit exploitation strictly to what is necessary to validate the existence of a vulnerability.
• Access only test accounts created for the purpose of research (maximum of two test accounts).
• Use only the Official Channels for all vulnerability-related communication.
• Submit one vulnerability per report unless a chain is required to demonstrate impact.
• Permanently delete all data obtained during testing after reporting the issue.
• Immediately stop testing and notify us if any sensitive data (e.g., personal data, confidential business information, credentials) is encountered.

Prohibited Activities

The following activities are not permitted under any circumstances:

• Public disclosure of any vulnerability without YWO’s prior written approval.
• Any form of social engineering, phishing, impersonation, or physical intrusion.
• Denial of Service (DoS) or stress testing.
• Automated or high-volume scanning tools.
• Manipulation of live customer accounts or production data.
• Targeting customer support forms or communication channels intended for clients.
• Lateral movement attempts, privilege escalation beyond proof-of-concept, or persistent access

2.3. Reporting a Vulnerability (Official Channels)

All vulnerability reports must be sent to: support@ywo.com

Please include as much detail as possible, including:

• A clear description of the issue and where it was found.
• Step-by-step instructions to reproduce the vulnerability.
• Proof-of-concept evidence (screenshots, scripts, logs).
• Your testing IP address, device/user-agent, and test account usernames.
• Impact assessment if known.
• English-language reports are preferred.

For sensitive findings, you may encrypt your report using our PGP key (see section 4).

2.4. Scope of Testing

a) In Scope Systems

The following systems are authorised for testing:

• YWO Public Website https://ywo-za.com/
• YWO Mobile Applications (iOS & Android)

b) Out-of-Scope Systems/Service

The following are not authorised:

• Any domain, service, or infrastructure not specifically listed as in scope.
• Third-party service providers, vendors, or partners.
• Internal corporate systems, employee tools, or back-office applications.
• Social media platforms or marketing tools.

If uncertain, contact YWO for clarification before initiating testing.

2.5. Response Targets

We will strive to:

• Acknowledge reports within 2 business days
• Begin assessment within 4 business days
• Maintain open communication and provide progress updates
• Confirm resolution once the vulnerability has been addressed

Please note that timelines may vary depending on the complexity of the vulnerability and internal testing requirements.

3. FEEDBACK

We welcome suggestions for improving this Policy. For feedback, please contact: support@ywo.com

4. PGP KEY FINGERPRINT

For sensitive or confidential reports, we encourage you to use encryption. You may send PGP-encrypted emails using our public key.