Security

Zozo Sec

Disclose any security issues to our security team. This page defines what is covered, how to report it, and what we promise in return.

Report to

Security reports only. For anything else, see Contact

security@zozo.sh

Email

In scope

zozo.sh
This website.
*.zozo.sh
Every subdomain we run, and the apps and services on it. That covers the Zozo Suite (Zozo Chat, Zozo Studio and Zozo Agent) and the software and infrastructure that Zozo AI owns or operates to power them.
Not covered
Platforms run by our providers, such as Stripe, Supabase, Cloudflare, OpenRouter and Runware. Report a flaw in one of those to the provider. A mistake in how we have set one of them up is ours, and is in scope.

How to report

Email security@zozo.sh, in English. A report we can act on quickly includes:

  • what the problem is and where it is: the address, feature or request involved;
  • the steps to reproduce it, or a proof of concept;
  • what you think an attacker could do with it;
  • the account you tested with, if any, so we can tell your testing apart from an attack.

Leave other people's personal information out of the report. If you came across some, tell us where it was and stop there.

How we respond

Acknowledgement
Within 3 business days of your report.
Assessment
Within 10 business days, we tell you whether we could reproduce the problem and how serious we judge it to be.
Fix
We fix confirmed problems as fast as their severity calls for, keep you updated while we work, and tell you when the fix is live.
Credit
If you want it, we credit you publicly once the problem is fixed. We do not pay bounties at this time.

Ground rules

Research is in good faith when you:

  • test only with accounts you own, or with the account holder's explicit permission;
  • do not read, change or delete data that isn't yours, and stop and report as soon as you come across any;
  • do no more than is needed to show that the problem exists;
  • leave the service working for everyone else: no denial-of-service testing, flooding or spam;
  • do not use social engineering or phishing against our staff, users or providers, and do not attempt physical access;
  • give us a reasonable time to fix the problem before you tell anyone else about it. We ask for 90 days unless we agree otherwise.

Safe harbor

If you follow this policy in good faith, we consider your research authorized. We will not take or support legal action against you for it, and we will not ask law enforcement to investigate you for it.

Where this policy conflicts with our Website Terms of Use or the Zozo Chat Terms of Service, we will not enforce those terms against research that follows it.

If someone else takes legal action against you over research that followed this policy, we will make it known that you acted with our authorization.

We can only authorize testing of our own systems, so this promise does not extend to systems run by anyone else. If you are unsure whether something is covered, ask us at security@zozo.sh before you test it.

Last updated October 7, 2026. The same contact details are published for automated tools at /.well-known/security.txt.