01How to report
Email support@zeerow.com with the subject "Security" and:
- a description of the issue and where it is;
- steps to reproduce it, with screenshots or a short video;
- the impact you think it has; and
- your name and contact, if you want to be credited.
We will acknowledge your report within 2 working days and keep you updated until it is fixed.
02In scope
- zeerow.com and its subdomains, including company-specific zeerow links
- The zeerow web app and its APIs
03Out of scope
- Systems of our banking, payment or card partners (please report to them)
- Denial-of-service or load testing
- Social engineering, phishing or physical attacks
- Reports from automated scanners without a working proof of concept
- Missing best-practice headers with no real security impact
04Rules for testing
- Use only accounts you own or have permission to test. Never access, change or delete other users' data.
- Do not make real payments or move money other than test amounts in your own account.
- Stop and report as soon as you find an issue. Do not share it publicly until we have fixed it.
05Safe harbour
If you follow this policy in good faith, we will not take legal action against you for your research, and we will work with you to understand and fix the issue quickly.