Report a vulnerability

Email security@zyberon.ai with a description of the issue, the steps to reproduce it, the affected address or component, and the impact you expect. Screenshots or a short proof of concept help. Our machine readable contact details are in security.txt.

You can write in English or Dutch. Please include no personal data of other people beyond what is needed to show the issue.

We confirm that we received your report within three business days, and we give you a first assessment within ten business days.

We keep you informed while we work on a fix and tell you when it is resolved. We aim to fix critical issues within 7 days and serious issues within 30 days.

With your permission, we credit you by name once the issue is fixed. We do not run a paid bug bounty program at this time.

In scope: zyberon.ai and its subdomains, the Zyberon dashboard and its APIs, the funnels and tracking endpoints we host for stores, and our Shopify app.

Out of scope: services operated by third parties (such as Shopify, Meta or our sub-processors), findings from automated tools without a demonstrated impact, missing best practices without a concrete risk, and issues that require an already compromised device or account.

If you act in good faith and follow this policy, we consider your research authorized, we will not take legal action against you, and we will not report you to the authorities for it. If a third party takes action against you, we will make clear that your research was authorized under this policy.

Annex III of our Data Processing Agreement describes the technical and organizational measures we apply, and our sub-processor page lists the providers that process data for us.