Vulnerability Disclosure Policy

Email security@zdefence.com with: affected URL/version/endpoint, description, reproduction steps, impact, and remediation suggestion. Include only your own test data; do not include third-party personal data, vault contents, or safety-session locations. Encrypt with PGP if we publish a key ([PLACEHOLDER — publish only if genuinely supported]). Response target: acknowledge within [PLACEHOLDER — e.g. 3] business days; status updates every [PLACEHOLDER]; remediation aim 90 days before coordinated disclosure.

• In scope: zdefence.com website, public APIs (/api/reservations, /api/privacy/*), authentication flows, cookie/consent controls.
• Out of scope: third-party services (Clerk, Supabase, hosting/CDN, threat feeds), social engineering/phishing of staff, physical attacks, DDoS/volume testing, spam, or testing safety features against non-consenting third parties.
• Destructive, data-exfiltrating or service-degrading testing is prohibited. Stop and report if you access another user's data.

We ask for good-faith, non-disruptive research, confidentiality until remediation, and no public disclosure before the agreed date. [LEGAL REVIEW REQUIRED] Any safe-harbour (authorisation/non-prosecution) language must be reviewed before publication — we do not promise legal protection we cannot give. No bounty is offered unless stated; we credit reporters who wish it. Version 0.9.0-draft, last updated 2026-10-02.