Security

Reporting a vulnerability

We value good-faith security research. If you believe you have found a vulnerability in znakos.com or a related ZnakOS service, please write to info@znakos.com. Our security.txt has the same contact.

What to include

• A clear description and the affected address or component.
• Steps to reproduce, and the impact as you understand it.
• Any proof of concept, kept as small as possible.
• How we can contact you, and whether you want credit.

What we ask of you

• Test only against znakos.com and its subdomains, and only to the extent needed to show the issue.
• Do not access, change, copy or delete data that is not yours. Stop as soon as you reach someone else's data and tell us.
• Do not run denial-of-service, spam, social-engineering or physical attacks, and do not test against third parties.
• Give us reasonable time to fix the issue before you disclose it publicly. We aim for 90 days at most.

What you can expect from us

• An acknowledgement within 5 working days.
• An assessment, and updates as we fix the issue.
• Credit if you want it, once the issue is fixed.
• We will not pursue legal action against research that follows this policy in good faith, to the extent applicable law allows. This is not an authorisation to break the law.

We do not currently run a paid bounty programme.

Out of scope

Reports of missing security headers without a demonstrated impact, automated scanner output without a working exploit, spam, and issues in third-party services.