Security and Vulnerability Disclosure

ZARS Solutions welcomes reports from anyone who finds a security vulnerability in this website. This policy explains how to report one and what we ask of you while you look.

How to report

Email info@zarssolutions.com with the subject “Security vulnerability report”. Please include:

• the page or address affected and the type of issue;
• the steps needed to reproduce it, and any proof-of-concept;
• what an attacker could do with it;
• how we can reach you, if you would like us to follow up.

Please do not include other people’s personal data in your report. The same contact details are published in our security.txt file.

ZARS clients: to report a security incident affecting your own systems, contact ZARS through the support channel in your agreement rather than through this page.

Scope

This policy covers www.zarssolutions.com and zarssolutions.com.

It does not cover:

• systems belonging to ZARS clients, which must never be tested on the basis of this policy;
• services and platforms run by third parties that ZARS uses. Please report issues in those platforms to their owners directly;
• email accounts, staff, offices or physical locations.

Rules for good-faith research

While researching, please:

• test only within the scope above, and stop as soon as you have confirmed a vulnerability;
• do not run denial-of-service tests, load tests or automated scans that degrade the website;
• do not use phishing, social engineering or physical attacks;
• do not access, change or delete data that is not yours, and do not keep any data you come across;
• do not submit large numbers of test entries through the website’s forms;
• give us reasonable time to fix an issue before you disclose it publicly, and coordinate the timing with us.

What ZARS will do

• acknowledge your report and keep you informed of our progress;
• look into every report and fix confirmed issues as quickly as we reasonably can;
• credit you once the issue is fixed, if you would like that;
• not pursue legal action against you for research that follows this policy in good faith. This does not authorize testing of anything outside the scope above, and it cannot bind third parties.

ZARS does not run a paid bug bounty program.