Security

We take the security of Zacess and the people who use it seriously. If you find a vulnerability, please tell us privately so we can fix it before anyone else finds it.

Zacess is pre-release. Today that means this website. The browser version and the published code will follow.

How to report a vulnerability

Email contact@zacess.com with "Security report" in the subject.

Please do not open a public issue or discussion for a security problem. Public posts can put people at risk before a fix is ready.

What to include

  • what you found and where: the address, page or part of the code
  • the steps to reproduce it, as simply as you can
  • what an attacker could do with it
  • any proof of concept, screenshots or logs that help
  • how you would like to be credited, if at all

What happens next

  • We will reply within a few working days to confirm we have your report.
  • We will keep you updated while we investigate and fix it.
  • We will let you know when it is fixed and agree with you when it can be made public.
  • With your permission, we will thank you by name when the fix is announced.

Scope

In scope:

  • this website, zacess.com
  • the browser version at app.zacess.com, once it exists
  • the Zacess code, once it is published at zacesshq/zacess on GitHub

Out of scope: services run by others, such as GitHub and Cloudflare, which have their own reporting routes. Reports from automated scanners with no demonstrated impact are also out of scope.

Safe harbour

If you act in good faith, we will not take legal action against you or ask anyone else to. Acting in good faith means that you:

  • only test against what is in scope
  • avoid harm to people's privacy, data and access to the service, including denial of service and spam
  • stop as soon as you reach anyone else's data, keep nothing and tell us
  • give us a reasonable time to fix the problem before you share anything about it
  • do not ask for payment in return for not disclosing a problem

We do not run a paid bug bounty. We are grateful for every report and will credit you if you would like.

A machine-readable version of this contact is at /.well-known/security.txt.

Last updated on 13 October 2026.