1. INTRODUCTION 

​

Unconventional Thinker Ltd. takes the security of Resilience by YQ and its users’ data seriously. We welcome responsible disclosure from security researchers who identify potential vulnerabilities in our application, API, or infrastructure. This policy outlines how to report vulnerabilities and what to expect from us. 
 

2. SCOPE 
 

In scope: 
 

• Resilience by YQ iOS application 

• resiliencebyyq.com and associated subdomains 

• Backend API endpoints serving the application 

• Authentication and session management 

• Data storage and encryption implementation 

• Third-party integrations as they relate to our implementation (not the third party’s own infrastructure) 
   

Out of scope: 
 

• Third-party services we use (AWS, xAI, OpenAI, Anthropic, Neon, Apple, Resend) — report these directly to those providers. Note: geocoding uses a self-hosted GeoNames dataset, not a live third-party call — vulnerabilities in our import/lookup code are in scope, not out of scope. 

• Social engineering or phishing attacks against our team 

• Physical attacks against our infrastructure or offices 

• Denial of service (DoS/DDoS) attacks 

• Automated scanning without prior written authorization 

• Accessing, modifying, or deleting another user’s data 
   

3. HOW TO REPORT 
 

Email: security@thinkyq.com 

Include in your report: 
 

• Description of the vulnerability 

• Steps to reproduce (as detailed as possible) 

• Affected component (app, API, website, infrastructure) 

• Potential impact assessment 

• Any supporting evidence (screenshots, logs, proof of concept) 

• Your preferred contact method for follow-up 

Do NOT include any actual user data in your report. If you inadvertently access user data during your research, stop immediately, do not store or share it, and report the access path. 
 

4. OUR RESPONSE COMMITMENT 
 

• Acknowledge receipt within 48 hours 

• Provide an initial assessment and severity classification within 5 business days 

• Keep you informed of remediation progress at reasonable intervals 

• Notify you when the vulnerability has been resolved 
   

5. SAFE HARBOR 
 

If you conduct security research in compliance with this policy, we will: 
 

• Consider your research authorized and will not pursue civil or criminal legal action against you 

• Work with you to understand and resolve the issue 

• Not penalize you for accessing our systems in the course of good-faith research 

• Recognize your contribution (with your permission) unless you prefer to remain anonymous 
   

This safe harbor applies only to legal claims under our control. It does not bind third parties. If a third party initiates legal action against you for activity conducted in compliance with this policy, we will make it known that your actions were authorized under this policy. 
 

6. WHAT WE ASK OF RESEARCHERS 
 

• Act in good faith — research should aim to identify and report vulnerabilities, not exploit them 

• Do not access, modify, delete, or exfiltrate any user data 

• Do not degrade the performance or availability of the service 

• Do not perform automated scanning or testing without prior written authorization from security@thinkyq.com 

• Allow reasonable time for us to address the issue before any public disclosure 

• Do not disclose the vulnerability to third parties until we have confirmed remediation or agreed on a disclosure timeline 
   

7. BUG BOUNTY 
 

We do not currently operate a formal bug bounty program. We may introduce one in the future. In the meantime, we sincerely appreciate responsible disclosures and will acknowledge contributions with the researcher’s permission. 
 

8. CONTACT 
 

Security reports: security@thinkyq.com 
General privacy inquiries: privacy@thinkyq.com 
Website: resiliencebyyq.com 

​