01Our commitment
Security is what we do, and we hold our own systems to the same standard we set for clients. If you believe you have found a vulnerability in a ZyphraSec system, we want to hear from you. We will work with you to verify and fix it quickly.
02Scope
In scope
zyphrasec.comandwww.zyphrasec.com- Any other subdomain of
zyphrasec.comthat ZyphraSec operates
Out of scope
- Third-party platforms we use, such as Google, social networks, CDN and hosting providers. Report issues there to the vendor directly.
- Systems belonging to our clients. Never test a client environment because of a connection to ZyphraSec.
03What we want to hear about
- Cross-site scripting (XSS) with real impact
- Injection flaws: SQL, command, template and similar
- Authentication or authorization bypass
- Exposure of sensitive or personal data
- Server-side request forgery (SSRF) and remote code execution
- Subdomain takeover or DNS misconfiguration
- Security misconfigurations with a demonstrated, exploitable impact
04Usually not accepted
- Missing security headers or best-practice findings with no demonstrated impact
- Clickjacking on pages with no sensitive actions
- Self-XSS, or issues that need an already-compromised device
- SPF, DKIM or DMARC configuration reports without a working spoofing proof
- Denial-of-service, volumetric or rate-limit issues on non-sensitive endpoints
- Software version disclosure without a working exploit
- Unvalidated automated scanner output
- Social engineering, phishing or physical attacks
05Rules of engagement
- Do not run denial-of-service tests or anything that degrades the site for others.
- Do not use high-volume automated scanning.
- Access only the minimum data needed to prove the issue. If you reach personal or confidential data, stop and report it immediately. Do not copy, keep or share it.
- Do not modify or delete data, and do not plant backdoors or persistent changes.
- Do not use social engineering against our team, clients or partners.
- Keep the vulnerability confidential until we have fixed it and agreed on disclosure.
- Follow all applicable laws, including the Information Technology Act, 2000.
- Do not make demands for payment in exchange for withholding or releasing a finding.
06How to report
Email reach@zyphrasec.com with the subject line [Security] short title. Please include:
- The affected URL or asset
- A clear description of the vulnerability and its impact
- Step-by-step reproduction instructions or a proof of concept
- Screenshots, request/response samples or video, if helpful
- How you would like to be credited, if at all
Our machine-readable contact details are published at /.well-known/security.txt.
07What you can expect from us
to acknowledge your report
to share our triage assessment
target for a fix and coordinated disclosure
We will keep you updated while we work on a fix. With your permission, we will publicly credit you once the issue is resolved.
08Safe harbor
If you act in good faith and follow this policy, we will consider your research authorized. We will not pursue or support legal action against you for it. If a third party takes legal action over activity that complied with this policy, we will make it known that your actions were authorized by us.
This safe harbor covers ZyphraSec systems only. We cannot authorize testing of third-party systems.
09Rewards
We do not currently run a paid bug bounty program. Valid, previously unknown reports receive our sincere thanks and, if you wish, public acknowledgement.