How can I be credited for my findings?

After the vulnerability is patched, we will ask if you would like to be included in our Security Hall of Fame. You can choose to be credited with your full name, a handle, or remain anonymous.

I need to send sensitive proof-of-concept (PoC) information. How can I do so securely?

For highly sensitive reports, we recommend using our PGP key to encrypt your message and any attachments. You can download our public key from the link on this page.

What is your policy on public disclosure?

We support responsible disclosure. We ask that you allow us a reasonable amount of time (typically 90 days) to address the vulnerability before making any details public. This allows our users to update and stay protected.

My report is about a third-party library or dependency. Should I still report it to you?

Yes, please do. We need to be aware of any vulnerabilities that affect our service, even if they originate from a dependency. We will work to promptly update the library and mitigate any impact on our systems.

Help Us Keep Zunoy Secure

Sub-headline: We deeply appreciate the efforts of security researchers and users who help us maintain the highest standards of security. If you’ve found a vulnerability, please report it responsibly using the form.

Vulnerability Disclosure Policy

We encourage responsible disclosure.

We commit to transparency and will credit researchers who report valid vulnerabilities (if desired).

Please allow us time to investigate and patch the issue before making any details public.

Avoid violating privacy, disrupting services, or destroying data during testing.

PGP Key & Secure Communication

For highly sensitive vulnerability reports, we strongly encourage you to encrypt your findings using our public PGP key. This ensures that the details remain confidential during transmission.

Download: Download our public key file here

Encrypt: Import the key into your PGP client (e.g., GPG, Kleopatra) and use it to encrypt your message and any attachments.

Send: Email the encrypted message to support@zunoy.com.

Download the Key

Safe Harbor Policy

Zunoy supports security research and welcomes good-faith efforts to improve the safety of our products and users. To encourage responsible reporting, we offer the following protections:

Respect Privacy & Service Integrity

Do not access, modify, or damage data beyond what is necessary to demonstrate the vulnerability. Avoid any actions that may disrupt Zunoy's services or users.

Act in Good Faith

Your testing and reporting should be aimed at improving security—not harming systems, extracting data, or seeking personal gain.

Submit Thoughtfully

Refrain from submitting low-quality or duplicate reports. Provide clear, actionable information to help us address issues efficiently.

Note: Please avoid accessing or exfiltrating customer or personal data. If you inadvertently access such data, stop immediately, do not save a copy, and contact us. Your report should describe the type of data accessed without including the actual data itself.

Rewards & Recognition

At this time, Zunoy does not operate a formal public bug-bounty program with monetary rewards. We do, however, publicly recognize contributors (with permission) and may offer swag, early product access, or other non-monetary appreciation. If a monetary bounty program is announced in future, we will publish details here.

Confidentiality & Disclosure

We will treat your report with discretion. If you prefer anonymity or a private disclosure, please tell us in your report. We will coordinate any public disclosure with you and will not publish identifying information without your consent.

Frequently Asked Questions

Can I test against production systems?

Only with prior coordination. Testing that risks data exposure or availability impact is not allowed without our consent.

Will I be compensated?

Currently no formal monetary bounty. We can publicly credit you (if you agree) and may offer other recognition.

Can I publish my findings?

Please coordinate disclosure with us. We will agree on a timeline to ensure users are protected before public release.

How long will it take to get a response after I submit a report?

We will acknowledge reports within 48 hours and provide progress updates. Resolution timelines may vary depending on severity and complexity.

Can I report a vulnerability anonymously?

Yes, you can. However, providing contact information allows us to collaborate with you more effectively, ask clarifying questions, and give you proper credit. We will never share your personal details without your explicit permission.

Your Mission, Our Support

Whether you are changing the world with innovation or impact, we are here to back you.

Apply for Credits

All our products come with a lifetime free tier.

Look at what Founders says about us,

Zunoy credits gave us the push to launch faster without worrying about costs.

Robert Fox

Founder, Early-stage Startup

The All-in-One SaaS Suite

One platform, one seamless experience. Everything you need to build, test, ship, and manage your team—with zero friction.

Operational

Mail Us

support@zunoy.com

Connect

CIN: U62090KA2025PTC197958

Dun & Bradstreet's DUNS Number: 772647201