Report vulnerabilities responsibly.

Send a concise report to security@zof.ai with the affected hostname or service, a description of the issue, the minimum steps needed to reproduce it, the security impact, and your preferred contact details. Include relevant timestamps and software versions when known. Use a test account and a harmless proof of concept.

Do not attach live credentials, large exports of personal data, or another customer’s confidential information. Describe any sensitive evidence in general terms and ask for a suitable transfer method. If you encounter data that does not belong to you, stop accessing it and report the circumstances promptly.

We review reports to understand impact, affected systems, and appropriate remediation. Acknowledgement, investigation, and resolution are separate steps; this public policy does not guarantee a response or remediation deadline. Follow up in the same thread with additional information.

• Contact security@zof.ai

The program concerns Zof-operated application, API, marketing website, and documentation services. Before active testing, send the exact hostname, intended test account, proposed method, and expected traffic to the security team to confirm the authorized scope. A Zof logo, link, integration, or similarly named domain is not evidence that Zof owns or can authorize testing of a system.

Customer-managed deployments, customer applications and repositories, cloud-provider infrastructure, and third-party services require authorization from their respective owners. This policy does not grant permission to access another tenant or override restrictions in a separate agreement. If you are unsure whether a system or method is authorized, ask before proceeding.

Use only accounts and data you own or have explicit permission to test. Limit testing to what is necessary to demonstrate the issue safely. Stop if a test could expose private information, change another person’s data, or materially affect service availability.

• Do not perform denial-of-service, load, resource-exhaustion, or high-volume automated testing without separate written authorization.
• Do not use phishing, social engineering, physical intrusion, malware, persistence, or credential stuffing.
• Do not modify or delete other users’ data, move laterally into other systems, or download datasets to demonstrate access.
• Do not send unsolicited communications to users, request payment from affected customers, or condition disclosure on a threat.
• Keep evidence securely, limit access to it, and coordinate its return or deletion when the investigation no longer requires it.

A useful report establishes an actual security consequence for an in-scope system. Explain the access required, affected role or tenant boundary, realistic attack conditions, and the confidentiality, integrity, or availability impact. Scanner output without a reproducible impact may need additional detail.

Severity is assessed in context. A vulnerability label alone does not establish priority: for example, an authorization issue may have very different impact depending on whether it affects one test resource or crosses a tenant boundary. Related reports may be treated as one underlying issue. Duplicate, previously known, or out-of-scope findings may not qualify for a reward.

The following ranges are the program’s published guidelines. Rewards are discretionary, depend on validated impact and report quality, and are not guaranteed for every submission or severity label. Zof determines eligibility and the final award after reviewing the report.

Reward participants must be at least 18, must not be current or former Zof employees, and must be legally eligible to receive payment under applicable sanctions and export-control requirements. Payment may require identity, tax, and payment information through an appropriate process. Do not email that information with the initial report.

• Critical: $5,000 to $15,000. Examples may include demonstrated remote code execution or broad authentication bypass with material impact.
• High: $1,000 to $5,000. Examples may include exploitable injection, stored scripting, or server-side request forgery with significant impact.
• Medium: $250 to $1,000. Examples may include a reproducible information disclosure or request-forgery issue with limited impact.
• Low: $50 to $250. A finding must still demonstrate a meaningful security effect; a missing header alone does not establish one.

Keep vulnerability details and sensitive evidence confidential while Zof investigates. Coordinate any public disclosure with the security team so affected systems and users can be protected. Do not publish private customer data or working exploit details that expose users to avoidable harm.

Zof can authorize testing only of systems it controls and only within the agreed scope. This policy does not waive third-party rights or provide immunity for unlawful activity. Good-faith research must remain within the authorized boundaries and applicable law.

For an active issue affecting your organization’s purchased service, use the contracted customer support and incident escalation path in addition to reporting a suspected vulnerability. This program is not an emergency response service.

• Customer support and escalation
• Security overview