Bug bounty
Help us keep Zicelo secure
If you find a vulnerability, tell us first. We respond within 3 business days and reward valid reports.
What we care about
- Access to meetings, transcripts, or settings of another account.
- Bypassing email code authentication or package limits.
- Injections (SQL, command), stored XSS, CSRF on actions that change data.
- Leaks of integration keys or session tokens.
- Vulnerabilities in the Windows program, Android app, or Chrome extension.
What’s excluded
- Denial of service attacks, spam, social engineering.
- Automated reports without a demonstrated exploitation scenario.
- Missing security headers without concrete impact.
Rules
- Test only on your own accounts. Do not access, modify, or delete others' data.
- Do not disclose the issue publicly before we fix it (we allow 90 days).
- Rewards depend on severity and report quality; determined after a fix.