Security
Your Invoices holds other people’s financial records. If you have found a way to reach data you should not, or to change the money on a document, we want to hear about it.
Reporting a vulnerability
Email security@yourinvoices.co.uk. Please include what you found, the steps to reproduce it, and what an attacker could do with it. A short proof of concept helps far more than a scanner report.
Our machine-readable contact details are published at /.well-known/security.txt in the format described by RFC 9116.
Who handles reports
Ryan Gash is the security developer and security contact for Your Invoices. He is the owner and lead developer of the service and is responsible for its security, its infrastructure, and the triage and remediation of everything reported here. Reports reach him directly rather than a queue, so you will be talking to the person who can fix the problem.
The service is operated by North East VAG Adaptions LTD (company number 15225495).
What we commit to
- We will acknowledge your report within 3 working days.
- We will tell you whether we consider it a vulnerability, and why, within 10 working days.
- We will keep you updated while we work on a fix, and tell you when it ships.
- We will credit you by name if you would like that, once the fix is live.
- We will not take legal action against you for research carried out in line with this policy.
In scope
- yourinvoices.co.uk and everything served from it, including the application and its API
- The mobile API under /api/mobile/v1
- The Your Invoices iOS app
- Authentication, session handling, and the separation between one business’s data and another’s
- Invoice, estimate and VAT calculation, and anything affecting the money on a document
- Billing, subscription state and plan entitlement
Out of scope
- Denial of service, volumetric or stress testing of any kind
- Social engineering, phishing, or physical attacks against anyone
- Reports from automated scanners with no demonstrated impact
- Missing security headers or cookie flags with no exploitable consequence
- Vulnerabilities in third-party services we build on - report those to Supabase, Cloudflare, Stripe or Resend directly
- Anything requiring access to another person’s account, device or email
Rules for testing
We do not run a paid bug bounty. What we can offer is a fast, honest response and credit for your work. In return we ask that you:
- Use only accounts you own, or test accounts you have created yourself.
- Do not access, modify or download data belonging to anyone else. If you reach another tenant’s data by accident, stop, and tell us what you saw.
- Do not run automated scans that generate significant load.
- Give us reasonable time to fix an issue before disclosing it publicly.
How we build
Tenant separation is enforced in the database with row-level security rather than in application code alone, so a mistake in one query cannot expose another business’s records. Money is held as integer pence and every total is derived from one shared calculation, so the figure on screen, in the PDF, in the emailed copy and in the mobile app cannot disagree. Privileged columns — plan, role, account ownership, and the archive and delete flags — are withheld from the client entirely and can only be changed by audited server-side routines.
This policy was last updated on 20 August 2026.