Security Reporting Policy

1. Responsible reports

We welcome good-faith reports of suspected security weaknesses in Zexiry-operated products and services. A useful report explains the affected feature, potential impact, and a minimal reproduction that does not expose another user’s private information.

This policy is a reporting channel, not authorization to attack our systems, bypass access controls, or test providers we do not operate. It is not a bug-bounty offer, a payment promise, a legal immunity agreement, or permission to conduct unrestricted research.

2. Safe testing boundaries

Use accounts, files, and resources you own or have explicit permission to test. Stop immediately if you encounter other users’ personal data, credentials, payment information, or confidential records. Do not download, change, or copy that material to prove the finding.

Do not attempt denial of service, load testing without permission, phishing, social engineering, credential stuffing, persistence, destructive commands, or physical access. Do not purchase domains, spend provider credits, post content, or send messages from another person’s account.

3. What to include

Email mail@zexiry.com with a descriptive subject, the affected URL or component, approximate time, expected behavior, observed behavior, and reproduction steps using your own test data. Include software versions and safe screenshots if they help.

Remove session cookies, API tokens, passwords, one-time codes, full payment details, and unrelated personal data. If the report cannot be reproduced safely without sensitive information, describe the limitation and ask for a secure way to continue rather than sending the secret.

4. Accidental access

If a vulnerability exposes another user’s data, report the minimum fact needed to identify the issue and stop testing that path. Do not contact the affected user using the exposed information or publish the data. Record only safe identifiers and the time of observation.

If your own account may be compromised, secure its login provider, review connected accounts, revoke access where possible, and contact support. A vulnerability report does not replace an urgent account recovery request.

5. Investigation and disclosure

We may ask for clarification, assess severity, reproduce the report, or coordinate a fix with a provider. Do not assume a report has been accepted or resolved until we communicate the relevant outcome. We do not guarantee a response time, reward, or public attribution.

Avoid public disclosure of exploit instructions or sensitive data while a credible issue is being assessed. Coordinate timing with us where possible. This request does not remove any rights or reporting obligations that applicable law preserves.

6. External services and generated apps

Reports about a hosting provider, registrar, identity provider, browser, runtime, or model provider may need to be sent to that organization’s security team. Do not test its infrastructure under this policy. We can help identify whether a report concerns our integration.

A generated app may have its own vulnerabilities after deployment. The app owner should review and maintain its code and hosting configuration. Generating or publishing an app through Zevol is not a security audit or a managed security service.

7. Handling the report

A report may contain your contact information, test-account details, technical logs, and correspondence. We process that information to investigate, communicate, protect the service, and meet applicable obligations under the Privacy Policy.

Keep a copy of your report and any relevant safe evidence. Do not use the reporting process to demand access, threaten disclosure, or collect sensitive information. Abuse is subject to the Terms and Acceptable Use policies.

Related policies and contact

For related responsibilities, see our Acceptable Use, AI Accuracy & Reliance, Account & Security, and Subscription & Billing policies. Contact mail@zexiry.com for questions about this supplement.