SECURITY
Report a vulnerability.
We build software that decides whether other software is allowed to run. If we get that wrong, we want to hear it from you before we hear it from an incident.
LAST UPDATED — 4 AUGUST 2026
Reporting
Email security@zerowrite.ai. If you would like to encrypt your report, ask for our PGP key in a first message and we will send it before you share details.
Please include, as far as you are able:
- The affected component and version — desktop app, service, website, or API.
- Steps to reproduce, ideally with a minimal proof of concept.
- What an attacker gains, and what access they need to start.
What we commit to
| Stage | Our target |
|---|---|
| Acknowledge your report | Within 2 business days |
| Initial assessment and severity | Within 5 business days |
| Fix or documented mitigation for critical issues | Within 30 days |
| Credit in the release notes | On request, at disclosure |
We will keep you updated as the fix progresses, tell you when it ships, and agree disclosure timing with you rather than imposing it.
Safe harbour
If you make a good-faith effort to comply with this policy, we will not pursue or support legal action against you for your research. Good faith means: you avoid privacy violations, degradation of service, and destruction of data; you only interact with accounts you own or have explicit permission to test; and you give us reasonable time to fix an issue before disclosing it publicly.
In scope
- The ZeroWrite desktop application and the Windows protection service.
- Bypasses of pre-execution interception — code that runs without a verdict.
- The licensing and update APIs, and the signature verification around them.
- This website, including authentication, sessions, and account isolation.
Out of scope
- Reports generated by automated scanners with no demonstrated impact.
- Missing security headers or cookie flags with no exploitable consequence.
- Social engineering of our staff or customers, and physical attacks.
- Denial of service through sheer volume.
- Detection misses — a sample ZeroWrite fails to flag is a false-negative report, not a vulnerability, and is very welcome through that channel.
How the product is designed to fail
These are deliberate properties, useful context when assessing impact:
- Rule packs are signed, not just encrypted. The engine rejects any pack whose Ed25519 signature does not verify. Rules drive quarantine and delete decisions, so an unsigned pack would be an arbitrary-file-deletion primitive.
- Updates are signed. Application updates are verified against a key embedded at build time.
- Licences verify offline. Entitlement is an Ed25519-signed token checked locally, so protection never depends on our servers being reachable.
- An expired subscription never disables protection. The engine keeps working on the last good rule pack. Updates stop; protection does not.
- Update failures are not fatal. A failed rule-pack update rolls back to the previous pack and keeps running.
What we do not claim
No product stops everything. ZeroWrite does not defend against an attacker who already has kernel-level or administrator-level control of the machine, and it is not a substitute for patching, backups, or least privilege. We would rather say so here than imply otherwise.
Related: Privacy Policy · Terms of Service