Reporting A Vulnerability
If you discover a security vulnerability in ZipLoom, please report it responsibly. Do not open a public GitHub issue or post publicly until we have had a chance to investigate and release a fix.
Email: security@ziploom.dev
Include as much detail as possible: the URL or component affected, steps to reproduce, what data or functionality could be compromised, and your assessment of severity.
What To Expect
- Acknowledgement within 48 hours
- Initial assessment within 5 business days
- Fix timeline communicated within 10 business days
- Credit in our release notes if you wish (optional, your choice)
Scope
In scope:
- ziploom.netlify.app, ziploom.dev, and any future ziploom.app domain
- Authentication and authorization bypasses
- Data exposure or cross-tenant access (IDOR)
- Injection vulnerabilities (SQL, XSS, SSRF)
- Secrets or credentials exposed in responses or logs
Out of scope:
- Denial of service attacks
- Social engineering of ZipLoom staff
- Vulnerabilities in third-party services we use (report directly to them)
- Issues requiring physical access to our infrastructure
Our Security Posture
- All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Row-Level Security enforced at the database layer — cross-tenant data access is impossible by design
- RBAC enforced at both API and UI layers
- Every data mutation is audit-logged with user, action, timestamp, and resource
- HTTP security headers: CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy
- Rate limiting on all public and authenticated endpoints
- Webhook signatures verified (Stripe, GitHub) before processing
- AI-generated content is never trusted as code input — it is scanned by the same security scanner we run on user repos
Safe Harbor
We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, following this policy. We ask that you avoid accessing or modifying user data beyond what is necessary to demonstrate the vulnerability, and that you do not perform actions that could impact service availability.