Last updated 16..07.2026

Zama Responsible
Disclosure Policy

At Zama, we value the work of security researchers and welcome responsible disclosures of security vulnerabilities. Our goal is to work collaboratively with the security community to identify, validate, and remediate vulnerabilities in a way that protects our users and our systems.

This document outlines our Responsible Disclosure Policy, including how to report vulnerabilities, what is considered in scope, and the expectations for researchers participating in our Bug Bounty Program.

Reporting a Security Vulnerability

All security issues must be reported privately using one of the following channels:

GitHub Security Advisories

If the vulnerability affects a Zama project hosted on GitHub, you may also report it directly via GitHub Security Advisories on the corresponding repository.

Using GitHub Security Advisories allows for private, coordinated disclosure with maintainers and enables streamlined remediation and publication workflows.

Regardless of the submission channel, we aim to acknowledge receipt of valid reports in a timely manner and will keep researchers informed as the issue is investigated and remediated.

Email Disclosure

You may report vulnerabilities by email at: security@zama.org

Please include sufficient detail to allow us to understand and reproduce the issue, including:

A clear description of the vulnerability
The affected product, service, or component
Detailed reproduction steps
The potential security impact
Proof of concept (PoC), screenshots, or exploit code, where applicable

Safe Harbor and Responsible Research

We consider research conducted in accordance with this policy to be authorized and in good faith. If you follow these guidelines, Zama will not pursue legal action against you for your security research.

By participating, you agree to:

Make a good faith effort to avoid privacy violations, data destruction, and service disruption
Not publicly disclose details of the vulnerability until it has been resolved or disclosure has been explicitly approved by Zama
Only access data and systems necessary to demonstrate the vulnerability
Stop testing and report immediately if you encounter sensitive data
Comply with all applicable laws and regulations

This safe harbor applies only to activities performed within the scope of this policy.

Prohibited Activities

The following activities are strictly prohibited:

Social engineering, phishing, vishing, or any attempt to manipulate Zama employees, contractors, or users
Physical attacks or attempts to gain unauthorized physical access
Mainnet exploitation, including exploiting vulnerabilities on production blockchain networks
Theft, destruction, or modification of data or assets
Attacks against Zama users or third parties

Any testing must be limited to what is strictly necessary to demonstrate the vulnerability and must avoid real-world harm.

In-Scope Vulnerabilities

We are interested in vulnerabilities that have a clear security impact. In-scope issues include, but are not limited to:

Web & Application Security

Injection vulnerabilities (SQL, NoSQL, OS command injection, template injection)
Cross-Site Scripting (XSS): reflected, stored, or DOM-based
Authentication and authorization flaws
Broken access control (including IDOR and privilege escalation)
Cross-Site Request Forgery (CSRF) with meaningful impact
Sensitive data exposure
Security misconfigurations with demonstrated exploitability
Input validation, deserialization, or logic flaws leading to security impact

Web3 & Cryptography-Related Vulnerabilities

Smart contract vulnerabilities (e.g. reentrancy, logic flaws, improper access control)
Incorrect or unsafe cryptographic implementations
Key management issues (exposed, reusable, or improperly derived keys)
Signature verification flaws
Improper randomness or entropy usage
Consensus or protocol-level logic flaws
Vulnerabilities affecting zero-knowledge proof systems or cryptographic primitives
Unsafe interaction between on-chain and off-chain components
Economic or incentive-related vulnerabilities with demonstrable exploitability

Reports are evaluated based on impact, severity, and likelihood of exploitation.

Out-of-Scope Vulnerabilities

The following issues are generally considered out of scope and are not eligible for rewards:

Issues without a clear security impact or that are purely theoretical
Denial of Service (DoS or DDoS) attacks
Vulnerabilities requiring unrealistic physical access or unlikely user interaction
Issues affecting outdated or unsupported browsers, operating systems, or dependencies
Missing best practices without an exploitable weakness
Missing security headers without demonstrated impact
Clickjacking and Tabnagging issues
Automated scan results without manual validation or exploitation

Zama retains final authority to determine whether a report is in scope.

Rewards and Recognition

Eligible vulnerabilities may be rewarded based on:

The severity and impact of the issue
The quality, clarity, and completeness of the report
The novelty of the finding

Reward amounts, if any, are determined on a case-by-case basis. Duplicate reports are rewarded only for the first valid submission.

Coordinated Disclosure

We support coordinated vulnerability disclosure and will work with researchers to agree on an appropriate timeline for remediation and, if applicable, public disclosure.

Code of Conduct

Our Bug Bounty Program follows a responsible and ethical security research model, inspired by industry best practices.

By submitting a report, you agree to:

Act in good faith and with the intent of improving Zama’s security
Avoid any action that could degrade, disrupt, or deny service to users or systems
Never attempt to extort, blackmail, or pressure Zama regarding a vulnerability
Respect the privacy and data of Zama users, employees, and partners
Provide Zama with reasonable time to investigate and remediate reported issues
Communicate responsibly, clearly, and professionally throughout the disclosure process

Failure to comply with this code of conduct may result in disqualification from the program.

Thank You

We appreciate the efforts of the security research community in helping keep Zama and its users safe. Responsible disclosures make a meaningful difference in improving our overall security posture.

For any questions related to this policy, please contact security@zama.org.

Zama Responsible Disclosure Policy