Vulnerability disclosure policy

We want Zautha to be safe for the people who sign in through it. If you believe you have found a security issue in Zautha, please tell us. This page explains how, what you may test, and what we commit to in return.

How to report

Email security@zautha.com with:

• where the issue is (the URL, endpoint, SDK package and version, or component);
• what an attacker could do with it (its impact);
• the steps to reproduce it, and any proof-of-concept you have.

Do not put personal data in your report, other than your own. If you need to show that you could read data, show it on an account or instance you created yourself. Our security.txt lists the same contact.

In scope

• zautha.com, api.zautha.com, login.zautha.com, dashboard.zautha.com and accounts.zautha.com;
• instances you create yourself in your own workspace, both development and production;
• the SDK packages we publish on npm and NuGet.

Within that scope, we are especially interested in:

• user enumeration: learning whether an email address or username has an account where Zautha promises not to reveal it;
• cross-tenant access: reaching the data, users or settings of another workspace or instance;
• rate limit bypass: getting around a rate limit, a lockout or the bot check. Show it with as few requests as you can; high-volume brute force is out of scope.

Out of scope

• other people’s accounts, workspaces and instances: test only with accounts you created;
• our customers’ custom domains and their applications;
• denial of service, load testing and high-volume brute force;
• social engineering of anyone, and physical attacks;
• third-party services we use (Cloudflare, Zoho, Polar, zSender, healthchecks.io, UptimeRobot): report those to their owners;
• missing headers or best-practice findings without a demonstrated impact;
• the raw output of automated scanners.

What we commit to

• We confirm that we received your report within 5 business days.
• We keep you updated until the issue is fixed.
• We follow coordinated disclosure: please give us 90 days from your report before you publish anything about the issue, and we will agree with you on when to publish if we fix it sooner.
• If you follow this policy in good faith, we consider your research authorized, we will not take legal action against you for it, and we do not consider it a breach of our Terms of Service.
• If you wish, we thank you by name when we publish the fix.

Rewards

We do not run a bug bounty and do not pay rewards for reports.