Report a security issue.

How to report

Email [email protected]. Reports in English are preferred. A useful report includes:

• The affected URL, service, or component.
• A description of the vulnerability and its potential impact.
• Step-by-step instructions or a proof of concept that reproduces it.
• The date you found it and any tools you used.
• How you would like to be credited, if at all.

Include only the minimum data needed to demonstrate the issue. Do not send credentials, personal information, or records you may have encountered. If a report requires encrypted transfer, email us first and we will arrange a secure channel.

What to expect

• We aim to acknowledge your report within three business days.
• We will confirm whether we can reproduce the issue and keep you informed as we work on it.
• We will tell you when the issue is resolved.
• With your permission, we will credit you once a fix is available.

Please give us a reasonable amount of time to fix the issue before disclosing it publicly, and coordinate the timing with us. CapZero does not currently run a paid bug bounty program.

Scope

This policy covers:

• capzero.ai and its subdomains, including news.capzero.ai.
• Any CapZero product or service made available under those domains.

The following are out of scope:

• Services operated by third parties, such as our hosting, email, and identity providers. Report those issues to the provider directly.
• Denial-of-service testing, load testing, or other activity that degrades service.
• Social engineering, phishing, or physical testing of CapZero staff or offices.
• Automated scanner output without a demonstrated security impact, such as a missing header alone.

Guidelines for research

When investigating a potential vulnerability:

• Notify us as soon as possible after you discover it.
• Do not access, change, or delete data that does not belong to you. Stop and report immediately if you encounter personal or institutional information.
• Use only accounts you own or have explicit permission to test.
• Do not use an exploit beyond what is needed to confirm the vulnerability.
• Do not install persistent access or move to other systems.

Good-faith research

If you make a good-faith effort to follow this policy, we will consider your research authorized, work with you to understand and resolve the issue, and will not recommend or pursue legal action against you for it. If a third party brings legal action against you for activities that complied with this policy, we will make that authorization known.

If you are unsure whether a test is consistent with this policy, email us before you proceed.

Other requests

For product security questions or assurance documentation, see Trust & engineering or contact [email protected]. A machine-readable version of this contact is published at /.well-known/security.txt.