Vulnerability Disclosure Policy

Last updated: 27 October 2026

360 Audit is a product and trading name of YOUX LTD., incorporated in England, company number 16105897. Registered office: Unit 2 Tower House, Hoddesdon, England, EN11 8UR. “We”, “us” and “our” mean YOUX LTD., operating as 360-Audit.com.

Contact: [email protected]
Website: https://360-audit.com

1. Reporting channel and scope

We welcome good-faith reports of suspected security issues affecting 360-Audit.com. Email [email protected] with the subject “Security vulnerability report”. This is a reporting and coordination policy, not an open invitation to carry out security testing and not a paid bug-bounty programme.

Our website and course delivery use Kajabi. Payment services may involve Kajabi Payments, Klarna, Clearpay and Link by Stripe. We cannot authorise testing of those providers, their shared infrastructure, other customers’ sites or any system we do not control. A custom domain pointing to a provider does not transfer that provider’s testing authority to us.

 

2. Permission before testing

Ordinary use of public pages and your own authorised account is permitted under our Terms of Service. Before any active vulnerability testing, obtain written authorisation defining the exact assets, methods, timeframe, accounts and provider permissions. Do not infer permission to scan, exploit, bypass controls or access data from this policy or from another website’s programme.

If you discover a suspected issue accidentally, stop before accessing additional data or escalating the activity, and report the minimum information needed for us to understand it. We may coordinate a provider-specific report or refer you to the provider’s authorised channel.

 

3. What to include

Send one issue per report unless an authorised chain is necessary to explain the impact. Include the affected URL or feature, a concise description, discovery time and timezone, steps observed, impact and a non-destructive explanation or proof already lawfully obtained. Redact personal data and secrets. Do not send stolen credentials, large datasets or weaponised payloads.

Do not perform additional exploitation merely to prove severity. If we need a demonstration, agree a safe method first. We will not ask you to buy a product, disclose unnecessary identification or pay a fee merely to report a vulnerability.

 

4. Prohibited activity

Do not conduct denial-of-service or load testing, automated invasive scanning, brute forcing, credential attacks, social engineering, phishing, physical intrusion or malware deployment. Do not change, delete, exfiltrate or retain other people’s information, access another user’s account, establish persistence or use a finding for leverage or extortion. Do not interfere with purchases, payments or course access.

If personal information or secrets are accidentally exposed, stop immediately, avoid copying more, secure any minimum evidence already held and contact us promptly. Do not circulate it. Agree secure evidence handling and deletion; do not retain unnecessary data. Nothing requires destruction of evidence that law requires to be preserved.

 

5. Our response and coordination

We will use reasonable efforts to acknowledge a genuine report, assess its impact, request clarification where needed and keep the reporter informed of material progress where we can. We do not promise a security team, a fixed response time or a particular fix date that we have not established.

We ask you to coordinate any public disclosure so users are not exposed before assessment and remediation. We will discuss a reasonable disclosure date and any extension with you rather than demand permanent silence. Do not publish personal data, secrets or exploit instructions that create an avoidable immediate risk. This request does not prevent lawful regulatory reporting, protected disclosures or obtaining professional advice.

 

6. Legal position and rewards

We will not pursue a claim solely because you make a good-faith report or undertake activity expressly authorised by us within the agreed scope. We cannot waive third-party rights, authorise unlawful conduct, guarantee immunity from prosecution, or bind Kajabi or other providers. If you are unsure, ask before testing.

No payment, reward, reimbursement or public credit is promised. Any exceptional recognition must be separately agreed, including attribution consent. We do not reject a potentially serious vulnerability merely because it concerns headers, email configuration or another category sometimes labelled “informational”; we assess actual impact and authority.

 

7. Use of reports and changes

You permit us to use your report as reasonably needed to assess and remediate the issue, obtain professional advice and coordinate with affected providers. This is not unrestricted ownership of your research or permission to publicise your identity. Personal information is handled under our Privacy Policy.

Changes apply prospectively. They do not retrospectively withdraw written testing authorisation or the good-faith protection described above for activity already conducted within its agreed scope.