YoSmart Inc.
Vulnerability disclosure program on security.txt yosmart.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
YoSmart does not currently operate a cash-based bug bounty program.
- Response
-
Within 3 days
Acknowledging receipt of the report within three (3) business days
- Safe harbor
-
Full
We will not pursue legal action against you for good-faith security research conducted in accordance with this policy.
- Hall of fame
-
Yes
With the reporter’s permission, YoSmart may, at its discretion, acknowledge significant contributions through public recognition (such as a Security Hall of Fame or release notes)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 4 excluded.
APIs 1
- APIs and backend services used by our mobile apps and IoT devices
Domains 1
- yosmart.com
Hardware and IoT 1
- Current generation YoLink Hubs, Sensors, Controllers, and other smart home devices officially released and supported by YoSmart
Wildcard domains 1
- *.yosmart.com
Products and areas 1
- YoLink App (iOS & Android)
Out of scope (4)
- Physical attacks against YoSmart offices or data centers.
- Social engineering (phishing) of YoSmart employees or customers.
- Third-party services or integrations not owned or controlled by YoSmart.
- Volume-based denial of service (DoS/DDoS) attacks or traffic flooding.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from YoSmart Inc.'s policy. "We" in these lines means the program, not this site.
While testing
-
Do not access, modify, or delete data that does not belong to you.
-
Do not execute attacks that could degrade the experience of other users (e.g., DoS).
-
Do not exploit vulnerabilities beyond what is necessary to demonstrate their existence.
-
Do not publicly disclose vulnerability details until YoSmart has had a reasonable opportunity to investigate and remediate the issue.
-
Provide us with sufficient information to reproduce the vulnerability.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.