White-hat policy
Security.
Good-faith security research is welcome within the scope below. If you find a vulnerability, send a private report so it can be investigated and fixed.
Scope
In scope: the public website zeroshell.dev and services operated under the zeroshell.dev domain. Out of scope: client websites (report to their owners), third-party providers such as Cloudflare, social engineering, physical attacks, volumetric denial of service, and automated scanner output without demonstrated impact.
Rules of engagement
Report privately.
Send findings to [email protected]. Include the affected asset, reproduction steps, impact, and any proof of concept.
Stay proportionate.
Test only what is needed to demonstrate the issue. No data exfiltration, persistence, lateral movement, or service degradation.
Respect privacy.
If you encounter personal or client data, stop testing, do not keep a copy, and report it immediately.
Allow time for a fix.
Allow a reasonable window for remediation before any public disclosure. Coordinated publication is welcome.
Safe harbor & response
Research performed in good faith and within these rules will not be pursued legally. Expect an acknowledgement within a few working days and updates until the issue is resolved. There is no paid bounty; with your consent, credit is given once the fix is published. A machine-readable policy is available at /.well-known/security.txt. See also contact — general enquiries: [email protected].
Encrypted email
Use the published PGP key for sensitive reports. The armored public key is available at /.well-known/gpg.asc. Confirm the fingerprint through a separate trusted channel before encrypting.
12C6 7C91 BB37 4459 D6F7 5350 D5A6 592F 7614 467D