YNAB

Description

At YNAB, we take security seriously. We work hard to protect our users and their data, staying ahead of emerging threats by collaborating with security researchers. If you discover a security vulnerability or think we’ve made a mistake, please report it to us immediately. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of YNAB not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Our Philosophy We’re on your side - we both want vulnerabilities to be found by you before malicious actors exploit them. However, we expect researchers to operate responsibly and in good faith. Please review the rules below before carrying out any type of testing: Test only your own accounts - do not access, alter, or interact with real user data. Follow responsible disclosure practices - report issues promptly and keep them confidential. Bugcrowd's standard disclosure terms always apply. Do not perform denial-of-service (DoS/DDoS) attacks - these disrupt our systems and users. Do not attempt social engineering, phishing, or physical security attacks - this includes trying to break into our offices or manipulate employees. Do not use aggressive automated scanning tools - they generate excessive traffic and may result in account lockouts. Do not waste time with non-security-related issues - we are only interested in actual security risks, not general application bugs. This includes broken links on our web app. Access/Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . If you need multiple accounts, use [email protected]. Excluded Submission Types User enumeration (during signup, login, or password reset). Email spoofing (SPF/DKIM settings exist but DMARC may be in testing). Denial of Service (DoS) attacks, unless it’s a rare case that crashes our server (e.g., malformed JSON input). Self-XSS (unless exploitable via the UI). Bugs affecting outdated browsers (only the latest versions of Chrome, Firefox, Safari, and Edge are supported). CSRF attacks on non-authenticated pages (including login/logout forms). TLS/SSL issues (unless extremely severe). Click-jacking. Subdomain takeovers (on Heroku-hosted subdomains - we have safeguards in place). Broken link hijacking (unless we are actively loading resources from an expired domain). Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.

In Scope (in scope)

✅ YNAB Web App & API (Staging) Our single-page application and private API endpoint are primary targets. You’ll see API calls when interacting with the app in your browser. ✅ Public API (Staging) The public API documentation references api.ynab.com, but please test using the URL https://staging-api.bany.dev/v1 and then select the production server https://api.ynab.com . ✅ YNAB Marketing Site (www.ynab.com) This is a WebFlow site and is low risk, as it stores minimal data. Findings are still appreciated. ✅ 2FA Sign-In Any security vulnerabilities related to two-factor authentication are in scope. Documentation can be found on our Support site . ✅ Any YNAB-owned host (*.ynab.com) Except for explicitly out-of-scope targets (listed below). Any other host verified to be owned by YNAB, like *.ynab.com, is in scope except for those noted above. Platform & Technology Stack Client-Side: Ember.js Single-Page Application Latest versions of Chrome, Safari, Edge, and Firefox supported Server-Side: Ruby on Rails 7.x (Running on Heroku) Ruby 3.x, Puma 6.x CrunchyBridge Postgres CloudFront CDN Marketing Site: WebFlow

Out of Scope (out of scope)

🚫 Production environments: https://app.ynab.com/ (Live production app). Our customers’ real data is off-limits! 🚫 Older desktop applications: YNAB 4, YNAB 3, YNAB Pro, YNAB Basic (Spreadsheet) 🚫 Support Site: https://support.ynab.com/ (Hosted by a third party) 🚫 YNAB Learn: https://learn.ynab.com/ (Hosted by a third party) 🚫 Internal Testing & Development Sites: https://develop-app.ynab.com 🚫 Any customer accounts or real user data 🚫 Testing beyond explicitly in-scope targets 🚫 YNAB Mobile Applications (iOS and Android)