Skip to Content

Yuzu Health Vulnerability Disclosure Policy

Last updated July 30, 2026

We welcome reports of security vulnerabilities in Yuzu Health systems and services. This policy explains how to report an issue and what to expect from us.

Reporting

  • Email security [at] yuzu [dot] health with a description of the vulnerability, the affected system or URL, and clear steps to reproduce it.
  • If possible, include the potential impact and any proof-of-concept details.

Scope

In scope:

  • Yuzu Health production systems and services, including yuzu.health and its subdomains

Out of scope:

  • Any system not owned or operated by Yuzu Health, including third-party vendors, integrations, or infrastructure
  • Open-source projects maintained by Yuzu Health
  • Excluded due to threat model or impact of testing:
    • Automated scans of any kind
    • Social engineering or Phishing
    • Self-XSS / Clickjacking
    • Denial-of-service attacks
    • Defense-in-depth or security best practice items without a chain to escalate, e.g. missing security headers (CSP), verbose error messages, cookie flag misconfigurations, or SSL/TLS configurations
    • Publicly available API pages

Guidelines

  • Make a good-faith effort to avoid privacy violations, data destruction, and service disruption.
  • Only interact with accounts you own or have explicit permission to test.
  • Do not access, modify, or exfiltrate data that does not belong to you.
  • Give us a reasonable amount of time to remediate before public disclosure.

What to expect

  • We will acknowledge your report and work with you to understand and resolve the issue.
  • We will not pursue legal action against researchers who report in good faith and follow this policy.