Responsible disclosure policy
Last updated: 2026-10-24 (draft)
ZETA-RETICULI.AI INC. welcomes reports of security vulnerabilities from researchers acting in good faith. This policy is referenced from /.well-known/security.txt.
How to report
Section titled “How to report”Email security@zeta-reticuli.ai (TODO (Tom): confirm this mailbox exists and is monitored). Include the affected URL or component, steps to reproduce, impact, and how to contact you. Please do not include other people’s personal data.
- In scope: zeta-reticuli.ai and its subdomains, and our published software and configuration.
- Out of scope: denial of service, social engineering, physical attacks, spam, findings that need a compromised device, and third-party services (e.g. Cloudflare, GitHub); report those to their owners.
- Test only against accounts and data you own, or an environment we give you for testing.
- Do not access, modify or keep data beyond what is needed to show the issue; stop and tell us if you reach sensitive data.
- Do not degrade service for others.
- Give us reasonable time to fix the issue before public disclosure (we suggest 90 days; we can agree another date).
Our commitments
Section titled “Our commitments”- Acknowledge your report within 3 business days (TODO (Tom): confirm) and keep you updated.
- Not pursue or support legal action against good-faith research that follows this policy. TODO (counsel): safe-harbor wording.
- Credit you, if you wish, once the issue is fixed.
We do not currently run a paid bug bounty.