We would rather hear about a problem in our own systems from you than from a customer. This page is the policy for that. A machine-readable copy is published at /.well-known/security.txt.
In scope
The ZeroFlare public website and other systems ZeroFlare LLC operates. If you are unsure whether a host is ours, ask before you test it.
Out of scope
Customer systems are out of scope. Testing them requires a contract with that customer, not this policy.
Also out of scope: social engineering of our staff or clients, physical attacks, denial of service, spam, and any testing that degrades the site for other people. Do not access data that is not required to prove the issue. If you encounter personal data, stop and tell us. Do not copy it, and do not include it in a public write-up.
How to report
Email hello@0flare.com. Include a description, the impact you believe it has, and the steps to reproduce. English, French, and Arabic are all fine.
Please give us a chance to fix the issue before you publish details. We ask for 90 days from the day we acknowledge the report, unless we agree a different window with you.
What we will do
We will acknowledge a report that has enough detail to act on within 3 business days. We will keep you informed of the fix at a reasonable interval, and we will tell you when it is deployed.
We do not operate a paid bounty program. We will credit researchers who want to be named, once the issue is fixed, unless you would rather stay unnamed.
Good faith
If you follow this policy, act in good faith, and avoid privacy violations, destruction of data, and interruption of the service, we will not pursue legal action against you for that research. This does not bind our customers, and it is not a waiver of rights that cannot be waived.