Responsible Disclosure Policy

Safe harbor & legal commitment

We consider security research to be a valuable activity. If you conduct your research and reporting in good faith and in strict compliance with this Policy, Codezep commits to the following:

1. 1.
   No Legal Action: We will not pursue civil or criminal legal action against you or initiate a complaint to law enforcement for accidental or good-faith violations of this Policy.
2. 2.
   No Account Suspension: We will not suspend or terminate your account if you are a legitimate user testing your own account within the boundaries of this Policy.
3. 3.
   Exemption: If your security research involves a violation of our Terms of Service (e.g., reverse engineering), we waive those restrictions for the limited purpose of your security research under this Policy.

Note: We cannot bind third parties (e.g., our hosting providers or payment processors). If your actions violate their policies, you may still be liable to them.

Scope

Rules of engagement

To be eligible for Safe Harbor, you must adhere to the following rules:

1. 1.
   Do Not Harm: Do not access, modify, or delete data belonging to other users. If a vulnerability provides access to other user data, stop immediately and report it. Do not exfiltrate the data to prove the bug.
2. 2.
   Own Account Only: Perform testing only on accounts you own or have explicit permission to test.
3. 3.
   No Denial of Service: Do not perform DoS, DDoS, spamming, or fuzzing attacks that could degrade our service for legitimate users.
4. 4.
   No Social Engineering: Phishing, vishing, or any social engineering of Codezep employees, contractors, or customers is strictly prohibited.
5. 5.
   No Physical Attacks: Do not attempt to gain physical access to Codezep offices, data centers, or employees.
6. 6.
   Confidentiality: Do not disclose the vulnerability to the public or any third party until Codezep has resolved the issue and granted permission for disclosure.

Reporting a vulnerability

If you believe you have found a security vulnerability, please submit your report via email to security@zep360.com.

Response timeline

We are committed to open communication. When you submit a report, we aim to:

• •
  Acknowledge: We will acknowledge receipt of your report within 3 business days.
• •
  Triage: We will confirm the validity of the vulnerability within 10 business days.
• •
  Resolution: We aim to fix critical vulnerabilities within 30 days and non-critical issues within 90 days.
• •
  Notification: We will notify you when the fix is deployed.

Recognition and rewards

Non-qualifying vulnerabilities

The following issues are generally considered out of scope and will not be recognized, as they often have low or theoretical impact:

• •
  Clickjacking on pages with no sensitive actions.
• •
  Missing HTTP security headers (e.g., HSTS, CSP) without a specific exploitable proof of concept.
• •
  Automated scanner reports (e.g., from Nessus, OpenVAS) without manual validation.
• •
  Login/Logout CSRF.
• •
  Self-XSS (XSS requiring the user to paste code into their own browser).
• •
  Email spoofing records (SPF/DDKIM/DMARC) without proven impact.
• •
  Software version disclosure (banner grabbing).

Disclosure policy

Codezep supports Coordinated Disclosure. You agree not to publicly disclose the details of any vulnerability without Codezep’s written consent.

• •
  Once a fix is deployed, you are welcome to publish your research (e.g., blog posts, conference talks).
• •
  We prefer that you give us at least 30 days after the fix is deployed before publishing, to ensure all our customers' systems are updated.

Contact information

For security-related inquiries only, please contact:

For general support or bug reports (non-security), please contact support@zep360.com.