Report a vulnerability
Last updated
We’d rather hear about a problem from you than from an attacker. See how we protect store data and our live status.
1.How to report
Email [email protected] with what you found, the steps to reproduce it, and the impact you think it has. Screenshots or a short proof of concept help. Our security.txt lists the same contact.
Please don’t include real merchant or shopper data beyond what is needed to show the issue.
2.What we promise
- A reply within 2 business days, and an assessment within 5.
- Updates until it is fixed, and credit on this page if you want it.
- No legal action against good-faith research that follows this policy (safe harbor).
3.Scope
In scope: zevron.ai and its subdomains, the Zevron Shopify app, and our APIs (/api/*).
Out of scope: denial-of-service, spam or social engineering of our team or merchants, physical attacks, findings in third-party services we use (report those to the vendor), and reports from automated scanners without a demonstrated impact.
4.Ground rules
- Test only against your own accounts or a store you own. Never access, change or delete another merchant’s data.
- Stop and tell us as soon as you reach data that isn’t yours.
- Give us reasonable time to fix an issue before you disclose it publicly; we’ll agree a date with you.
5.Thanks
No reports yet. Researchers who report valid issues are listed here with their permission.