Report carefully. Avoid increasing harm.

Current reporting channel

A dedicated responsible-disclosure address is not yet published. The general contact form is not a secure vulnerability-reporting channel and must not be used for exploit details or sensitive evidence.

If you already have an established direct channel with Zeah Systems, use it to request a secure reporting path without sending exploit details in the first message. Otherwise, retain the report safely and check this page for an updated channel.

What a useful report includes

• The affected public hostname or product and version
• A concise description of the issue and likely impact
• Safe reproduction steps using your own accounts and data
• Relevant timestamps and sanitized evidence
• A way to coordinate once a secure channel is confirmed

What to avoid

• Do not access, copy, change, or retain data that is not yours
• Do not degrade service, use destructive testing, or create persistence
• Do not test real customer environments or third-party systems
• Do not publish unverified claims or sensitive details before coordination
• Do not send credentials, secrets, private keys, or live exploit payloads through the general contact form

Scope and limitations

This page is guidance, not a bug-bounty offer, payment promise, safe-harbor contract, or authorization to test systems beyond your own accounts and data. Product pilot environments require their own written scope.

Response expectations

Zeah intends to acknowledge valid reports, assess impact, coordinate remediation, and communicate status reasonably. No fixed response time or reward is promised on this early-stage website.