Skip to main content
Sign in

Security Policy

Last updated: 20th October 2026

1. Reporting a vulnerability

If you believe you have found a security vulnerability in YourCareHome, please report it to [email protected]. Every report is logged, and we aim to acknowledge it within 14 days.

Please include:

  • a description of the issue;
  • the steps required to reproduce it;
  • the potential impact as you see it; and
  • any logs, screenshots or proof-of-concept material that helps us verify.

2. What is in scope

  • yourcarehome.co.uk and its subdomains;
  • vulnerabilities in our application code, configuration or infrastructure that result in unauthorised access, data leakage, account takeover, payment manipulation, or similar real-world harm.

Payments are processed by Stripe; we do not store card details.

3. What is out of scope

  • denial-of-service attacks, volumetric or otherwise;
  • social engineering, phishing, or physical attacks against us or any provider;
  • vulnerabilities that require an already-compromised user device;
  • scanner output without a working proof of concept;
  • issues in third-party services we depend on (for example Stripe (checkout and billing portal), Cloudflare, or Google Maps Platform); please report those to the owners of those services;
  • missing security headers without a demonstrable exploit;
  • self-XSS, clickjacking on pages without sensitive actions, and similar low-severity reports without a real-world impact.

4. Bounty

We do not currently run a paid bug bounty programme. We may, with your consent, acknowledge material reports on this page.

5. Response time

We aim to acknowledge legitimate reports within 14 days, and to fix or mitigate confirmed issues as quickly as we reasonably can.

6. Safe harbour

YourCareHome will not pursue legal action against researchers who, in good faith, report security issues to us via the contact above and who:

  • act within the scope set out above;
  • avoid privacy violations, destruction of data, and disruption to our services;
  • do not access, modify, or exfiltrate user data beyond the minimum necessary to demonstrate the issue; and
  • allow us a reasonable time to fix the issue before any public disclosure.

7. Coordinated disclosure

We support coordinated disclosure. We ask that you give us 90 days from initial report (or sooner if we have already mitigated the issue) before publishing details. We are happy to credit you on this page if you would like to be named.

8. Machine-readable contact

A machine-readable version of this contact information is available at /.well-known/security.txt in the format described by RFC 9116.

9. Updates

This policy may be updated from time to time. The most recent version is always at /security-policy/.