Yarbo Bug Bounty Program Terms

1.Project Overview

1.1 Program Nature and Contractual Relationship

1.2 Program Scope

In-Scope Asset Categories

Excluded Assets & Testing Activities

1. Third-party hosted subdomains and external platforms: help centers, system status dashboards, community forums, corporate blogs, career recruitment portals, and independent third-party marketplace integrations. Any vulnerabilities affecting these external services must be reported directly to the respective platform operator, not Yarbo.
2. Non-production environments: development, staging, test, user acceptance testing (UAT), and all pre-release staging environments not designated for live customer use.
3. Embedded third-party authentication and payment gateways: security flaws within Google Sign-In, Apple ID Login, Stripe, PayPal or other external payment/authentication providers are the sole liability of the third-party service vendor.
4. Non-Yarbo operated domains: authorized reseller websites, partner landing pages, discontinued legacy products, and retired domain names no longer covered under Yarbo’s active security maintenance lifecycle.
5. Low-impact attack vectors lacking verifiable material adverse impact: Denial-of-Service (DoS/DDoS) flooding, social engineering and phishing campaigns, cosmetic compliance gaps without functional exploitability (e.g., missing HTTP security headers, incomplete cookie flag configurations), and raw automated scanner output submitted without a working, non-destructive Proof of Concept (PoC).

1.3 Eligibility Restrictions

1. Current full-time, part-time, temporary Yarbo employees, plus all interns engaged by Yarbo within the immediately preceding twelve (12) calendar months;
2. Third-party contractors directly engaged to develop, maintain or audit Yarbo security products or backend infrastructure, as well as such contractors’ own employees and subcontractors;
3. Immediate family and household members of the persons described above (including spouses, parents, children, and full/half siblings);
4. Any individual listed on U.S. federal, international or multilateral government sanctions lists, or residing within a jurisdiction subject to U.S. export control regulations;
5. Minors under eighteen (18) years of age, or persons below the statutory age of majority required under the laws of their country/region of domicile (such individuals lack full legal capacity to enter binding contracts under this Program).

1.4 Vulnerability Submission Mandatory Requirements

1. Detailed, plain-language narrative description of the root cause and security flaw;
2. Linear, step-by-step reproduction instructions allowing Yarbo’s security team to replicate the vulnerability consistently;
3. Non-destructive Proof of Concept (PoC) code or demonstration (example: for Remote Code Execution (RCE) flaws, execute a harmless command such as echo "security test" with no destructive file/resource manipulation);
4. Full testing environment configuration details;
5. Affected URLs, mobile application identifiers, and relevant code snippets;
6. Exact hardware device model and targeted firmware version number;
7. Supporting testing artifacts: unaltered screenshots, log captures and network traffic recordings, attached to the formal report;
8. Formal impact assessment outlining the number of potentially affected end users and the risk scope of personal or sensitive data exposure.

Validity Standards for a Qualified Vulnerability Report

1. The vulnerability resides within the Program’s defined in-scope asset list and does not fall under any exclusion outlined in Section 1.2;
2. The vulnerability remains unlogged, undisclosed and unaddressed within Yarbo’s internal vulnerability tracking systems as of the report submission timestamp;
3. The report contains fully reproducible step-by-step instructions paired with a non-destructive PoC demonstration;
4. The submitting Researcher has fully complied with all binding provisions of this Program document.

Handling Concurrent Duplicate Vulnerability Reports

1. The exact submission timestamp logged within Yarbo’s internal vulnerability intake system shall serve as the exclusive, conclusive record for determining priority of discovery for identical flaws;
2. If two substantially identical vulnerability reports are filed within forty-eight (48) hours of one another, Yarbo may, in its sole and absolute discretion, allocate no less than fifty percent (50%) of the base bounty tier amount to each submitting Researcher;
3. This concurrent reporting allocation framework applies on a case-by-case basis only and shall not establish a binding precedent for future duplicate submissions.

2.Vulnerability Severity Classification Standards

• Volume and sensitivity of user data susceptible to unauthorized exposure;
• Technical ease of exploitation with minimal preconditions;
• Probability of material harm to Yarbo end users and overall business risk exposure;
• Total scope of impacted Yarbo web infrastructure, cloud services or physical devices.

• Total time the Researcher invested to identify the flaw;
• Out-of-pocket costs incurred by the Researcher to purchase Yarbo hardware or access paid testing tools;
• Vulnerabilities already logged and tracked within Yarbo’s internal remediation backlog prior to submission;
• All other subjective metrics that cannot objectively quantify functional exploit risk or user harm.

3.Web System Vulnerability Classification Guidelines

3.1 Critical Severity

3.2 High Severity

3.3 Medium Severity

3.4 Low Severity

4.Device & Mobile Application Vulnerability Classification Guidelines

4.1 Critical Severity

4.2 High Severity

4.3 Medium Severity

4.4 Low Severity

5.Reward Standards

5.1 Base Bounty Tier Amounts (USD)

5.2 Tier Bounty Adjustment Weighting Factors

1. Exploit Authentication Barrier: Unauthenticated exploitation > exploitation requiring standard user account login > exploitation dependent on rare, restrictive preconditions;
2. End User Impact Scope: All platform users vulnerable > segmented subset of users vulnerable > exploit limited to narrow edge-case usage scenarios;
3. Exposed Data Sensitivity: Payment/government identity data > geolocation and behavioral telemetry > non-sensitive public metadata;
4. Report Completeness: Full PoC + actionable production remediation guidance > complete reproduction steps only > high-level textual description without demonstration artifacts.

5.3 Eligible Supplementary Bonus Awards

5.4 Mandatory Preconditions for Bounty Disbursement

1. Yarbo’s internal security team has issued formal written written confirmation validating the vulnerability as bounty-eligible;
2. The Researcher executes, signs and returns the Yarbo Bug Bounty Program Non-Disclosure Agreement (the “Program NDA”) furnished by Yarbo;
3. The Researcher submits fully complete, legally valid tax documentation matching their residency status (Form W-9 for U.S. tax residents; Form W-8BEN for all non-U.S. tax residents);
4. The Researcher has fully complied with every binding term and provision of this Program document from report submission through final bounty disbursement.

5.5 Circumstances Where Bounty Payment May Be Fully Withheld

1. Yarbo independently discovered the identical vulnerability prior to the Researcher’s submission timestamp, or another Researcher filed a valid priority report covering the same flaw;
2. The submitted report fails to satisfy all validity requirements laid out within Section 1.4;
3. The Researcher materially violated any Program provision, including unauthorized system access, destructive testing operations, or premature public disclosure of unremediated vulnerabilities;
4. The Researcher falls under any eligibility prohibition defined within Section 1.3;
5. The Researcher provided materially false identifying information or submitted fabricated, non-existent vulnerabilities;
6. Yarbo had already launched active internal remediation workstreams targeting the documented vulnerability prior to the date of report submission.

• Reports consisting solely of raw automated vulnerability scanner output without functional verified exploit demonstration;
• Vulnerabilities corresponding to Common Vulnerabilities and Exposures (CVEs) already published to public global vulnerability databases prior to submission;
• Flaws affecting assets excluded from the Program’s in-scope asset list in Section 1.2;
• All testing activity violating the mandatory code of conduct in Section 8;
• Social engineering campaigns, physical hardware destruction testing, and DoS/DDoS flooding attacks against Yarbo infrastructure or devices.

5.6 Payment Mechanism & Timing

6.Tax Liability Provisions

6.1 Applicable Tax Regime Determination

• If bounty compensation is disbursed by Yarbo’s United States corporate affiliate (the “U.S. Entity”), the rules contained within Section 6.2 shall apply in full;
• If bounty compensation is disbursed by Yarbo’s People’s Republic of China corporate affiliate (the “China Entity”), the rules contained within Section 6.3 shall govern all withholding and reporting obligations. The exact paying corporate entity will be explicitly identified within the formal bounty award notification email delivered to the Researcher.

6.2 U.S. Entity Tax Compliance Rules

(A) Mandatory Withholding Tax Rules

(B) Tax Treaty Reduced Withholding Claims

(C) IRS Form 1099-NEC Mandatory Reporting

(D) Obligation to Notify Tax Status Modifications

6.3 China Entity Tax Compliance Rules

(A) Statutory Withholding & Remittance Obligations

(B) Income Classification & Statutory Tax Rate

(C) Accuracy of Submitted Banking & Identity Documentation

6.4 Tax Advice Disclaimer

7.Vulnerability Response & Remediation Timelines

1. Formal written receipt acknowledgment to Researcher: within seven (7) business days of report intake;
2. Complete initial vulnerability severity tier classification: within fifteen (15) business days of report intake;
3. Delivery of formal documented remediation implementation plan addressing the confirmed vulnerability: within thirty (30) business days following validation of a fully compliant bounty-eligible report.

8.Security Testing Code of Conduct

8.1 Safe Harbor Protections

1. All testing activity is strictly limited exclusively to the in-scope assets explicitly enumerated within Section 1.2 of this Program;
2. All research testing is conducted in good faith, without destructive system manipulation, and with no intent to obtain unlawful financial gain or competitive advantage over Yarbo;
3. The Researcher only accesses hardware devices, user accounts and testing environments they lawfully own, possess written authorization to audit, or that Yarbo explicitly provisioned for Program security testing purposes;
4. Immediately upon identifying a reproducible security vulnerability, the Researcher ceases all further exploit testing activity and submits a complete formal vulnerability report to Yarbo’s designated security intake mailbox;
5. The Researcher maintains strict confidentiality over all discovered vulnerabilities and refrains from disclosing any related technical details to any third party prior to receiving formal written public disclosure authorization from Yarbo.

8.2 Permitted Security Testing Activities

1. Conducting non-destructive security auditing and vulnerability testing on Yarbo hardware devices lawfully owned by the submitting Researcher;
2. Executing limited, non-intrusive test payloads that do not degrade service availability or disrupt experience for live Yarbo end users;
3. Immediately discontinuing all exploit attempts upon successful reproduction and confirmation of a functional security vulnerability flaw.

8.3 Strictly Prohibited Testing Activities

1. Unauthorized access, reading, mass downloading, modification or permanent deletion of any third-party user accounts, personal identifiable information (PII), or internal Yarbo employee data;
2. Launching DoS/DDoS flooding, traffic stress testing or resource exhaustion payloads that impair the operational availability of any Yarbo web, cloud or device backend system;
3. Bulk extraction, capture, local storage or retention of any Yarbo end-user personal data through automated scraping or exploit payloads;
4. Performing destructive hardware or firmware modification operations on any Yarbo device not fully owned by the Researcher;
5. Executing security testing against Yarbo hardware devices without prior explicit written testing authorization from an authorized Yarbo security representative;
6. Extracting confidential internal information via targeted social engineering campaigns including spoofed phishing email communications, employee identity impersonation, and pretexting;
7. Outsourcing all or any portion of vulnerability research testing work to external third parties, or collaborating on Program testing with individuals not bound to the full terms of this Program unilateral contract;
8. Filing identical or substantially identical vulnerability reports to competing third-party bug bounty platforms for separate monetary remuneration, absent prior written consent issued by Yarbo’s security team.

Mandatory Data Containment Response for Accidental PII Exposure

1. Immediately terminate all further testing activity targeting the affected asset;
2. Permanently delete all captured PII data stored on local testing workstations, cloud storage or mobile devices;
3. Fully document the exact sequence of events leading to accidental PII exposure within the formal vulnerability report submitted to Yarbo.

9.Confidentiality & Controlled Vulnerability Public Disclosure

9.1 Binding Confidentiality Obligations

1. Full text, artifacts and supporting evidence contained within the Researcher’s formal vulnerability report submission;
2. Yarbo proprietary internal system architecture, cloud network design and infrastructure topology documentation;
3. Yarbo production server IP addresses, internal private network routing schematics and firewall segmentation rules;
4. All proprietary Yarbo source code snippets, binary firmware logic and vulnerability remediation workarounds shared with the Researcher during triage;
5. All end-user personal identifiable information encountered during authorized security testing workflows.

1. Yarbo delivers formal written authorization approving public disclosure of the vulnerability;
2. Yarbo publishes an official public remediation security advisory fully resolving the flaw, and a minimum of thirty (30) calendar days have elapsed following the advisory release date;
3. Mandatory disclosure is compelled by binding applicable local, state or federal statute, court order or regulatory subpoena (the Researcher shall provide formal advance written notification to Yarbo’s security team prior to any compelled statutory disclosure).

9.2 Formal Vulnerability Public Disclosure Application Process

1. Complete Yarbo’s standardized Vulnerability Disclosure Request form and deliver the full document to security@yarbo.com via email;
2. Attach all complete supporting materials the Researcher intends to include within the planned public disclosure (blog posts, technical slides, PoC demonstration code, screenshots);
3. Yarbo’s security team shall initiate formal review upon receipt of a fully complete application package and issue written authorization upon internal approval.

1. No raw or redacted end-user personal identifiable information may be included;
2. No production Yarbo server IP addresses, internal network segmentation schematics or private infrastructure topology details may be published;
3. No narrative, technical detail or imagery that foreseeably harms Yarbo’s legitimate commercial business interests or end-user data security may be included.

10.Intellectual Property License Terms

11.Disclaimer & Limitation of Liability

12.Personal Data Protection & GDPR Compliance

13.Dispute Resolution & Governing Law

Bounty Award Reconsideration Appeal Process

14.Remedies for Material Program Term Breach

1. Immediate permanent disqualification of the Researcher from all present and future Program participation eligibility;
2. Full withholding of all outstanding unpaid bounty awards, plus formal demand for full repayment of any bounty amounts previously disbursed to the violating Researcher;
3. Formal written reporting of the violating conduct to relevant domestic or cross-border government law enforcement and cybersecurity regulatory authorities;
4. Initiation of civil litigation and pursuit of all available criminal liability remedies permitted under applicable local, state and federal cybersecurity statutes.

15.Severability & Entire Integration Clause

16.Official Program Contact Information