Vulnerability Disclosure Policy

1. How to report#

Email security@zerohuman.co with a description, steps to reproduce, the impact you think it has, and any proof of concept. Ask for our PGP key if you want to encrypt your report.

2. Scope#

In scope

zerohuman.co and its subdomains; the Ori Studio; sign-in and invite flows; the Origin API preview; content credentials and watermarking (for example, ways to strip or forge them).

Out of scope

Denial-of-service and load testing; social engineering or phishing of our staff; physical attacks; third-party services we don’t control (report those to the provider); reports from automated scanners with no demonstrated impact; missing headers or best-practice settings with no exploit.

3. Rules for research#

• Test only with accounts you own. Don’t access, change or delete other customers’ data. If you reach it by accident, stop, and tell us.
• Don’t degrade the service for others, and don’t use automated tools that send large volumes of requests.
• Give us reasonable time to fix an issue before you disclose it publicly. We’ll agree a date with you.

4. Our promise#

We keep you informed until the issue is fixed, and credit you publicly if you’d like.

5. Safe harbour#

If you act in good faith and follow this policy, we consider your research authorised. We won’t pursue legal action against you or report you to law enforcement for it, and if a third party does, we’ll make it known that you acted with our authorisation.

Version history