Security Policy

We want yusefbataineh.com to be safe for its visitors. If you believe you have found a security vulnerability in the site, we would like to hear from you, and we ask you to report it to us privately as described below.

How to report a vulnerability

Email hello@yusefbataineh.com, ideally with “Security” in the subject line. Please include:

a description of the issue and its potential impact;
the affected URL or feature;
the steps needed to reproduce it, with any proof of concept;
how we can contact you to follow up.

You can write in English or Arabic. Our contact details are also published in machine-readable form at /.well-known/security.txt.

What to expect

We aim to acknowledge your report within 48 hours.
We will investigate, keep you informed of our progress, and let you know when the issue is fixed.
Once the fix is live, we are glad to credit you for the discovery if you would like us to.

Scope

This policy covers the website at yusefbataineh.com, including its pages, forms and API endpoints. It does not cover:

services we use or link to, such as Supabase, Netlify, YouTube, ticketing providers and social networks; please report issues in those directly to the provider;
denial-of-service or load testing, and spam or automated mass submissions to the forms;
social engineering, phishing or physical attacks;
output from automated scanners without a demonstrated, exploitable impact.

Guidelines for good-faith research

Only test against accounts and data that you own, or that you have explicit permission to access.
Do not view, change or delete other people’s data. If you come across personal data, stop, do not keep a copy, and tell us.
Do not disrupt the site or degrade the experience of its visitors.
Keep test submissions to the forms to the minimum needed.
Give us reasonable time to fix the issue before you disclose it publicly.

Safe harbor

If you act in good faith and follow this policy, we will consider your research authorized, we will not pursue legal action against you for it, and we will work with you to understand and resolve the issue. If you are unsure whether something is allowed, ask us first. This commitment covers only our own systems and cannot bind third parties.

No bug bounty

We do not run a bug bounty program and do not offer payment for reports. We do value responsible disclosure and will gladly thank you for your help.

For how we handle personal data, see our Privacy Policy.