Security and vulnerability disclosure

Report a vulnerability

Write to security@yk-robotics.com. The address reaches the people responsible for product security, not a general inbox. Please include:

• the product and version, or the web address, affected
• the steps to reproduce the issue
• the impact you observed
• how we can reach you

You can write in English, Italian or Spanish. Keep personal or customer data in the report to the minimum needed to show the problem.

What happens next

We confirm that we received your report, assess it with the engineers who own the affected component and keep you informed until it is resolved. We agree with you when and how the issue is made public. If you wish, we credit you by name. We do not run a paid bug bounty.

Scope

In scope

• YK-Platform: configurator, editor, data studio and the runtime on the cell
• The YK License Manager and customer portal (license.portal.yk-robotics.com)
• app.yk-robotics.com and our remote support service
• This website, www.yk-robotics.com

Out of scope

• Products of other manufacturers (robots, cameras, PLCs): please report to them. If our integration is involved, we help coordinate.
• Denial of service, social engineering and physical attacks
• Output of automated scanners without a demonstrated impact

Good-faith research

If you act in good faith, we will not take legal action against you for your research. Good faith means that you test only what you need to show the issue, do not access, change or keep data that is not yours, do not disrupt production systems or customer cells, and give us reasonable time to fix the issue before you disclose it.

Suspicious emails

If an email that claims to come from YK-Robotics asks for a password, a licence key, a payment or a change of bank details, check it with your usual YK contact by phone before you act, and forward it to security@yk-robotics.com.