Security & Responsible Disclosure

1. Our approach

We build security products, so we hold ourselves to the standard we would expect from anyone handling our own data. The simplest protection is not having data in the first place: ZeroDay needs no account and by default sends only file hashes and minimal metadata, and our website has no analytics or third-party scripts.

This page describes our practices. It is not a certification or audit report, and the specific measures may change as we improve them. Our Privacy Policy covers what data we collect and how long we keep it.

2. How we protect data

Encryption

Connections to our website and ZeroDay’s update and reputation services are encrypted in transit with TLS. Customer data, uploaded files and backups are encrypted at rest.

Least-privilege access

Access to production systems and customer data is limited to the people who need it for their role, granted with the minimum permissions required, and removed when it is no longer needed.

Isolated analysis

Files and URLs submitted for analysis are processed in isolated sandbox environments, kept separate from our production systems and from other customers’ data, so that malicious code under analysis cannot reach them.

Deletion by default

• Website server and CDN logs are kept for up to 30 days.
• ZeroDay uploads whole files only if you turn on Sample sharing.

Payments

Card payments are handled by our third-party payment processor. Card details go directly to them, and we never receive or store full card numbers.

Software and downloads

We publish a SHA-256 checksum for the ZeroDay installer on our download page so you can check that the file you downloaded is the one we released. Only download ZeroDay from plasmatic.dev.

Monitoring and incident response

We monitor our systems for signs of abuse and intrusion. If an incident affects your data, we will notify you and the relevant authorities without undue delay, as the law and our agreements require, and tell you what we are doing about it.

3. Vulnerability disclosure policy

If you believe you have found a security vulnerability in our website or ZeroDay, we want to hear from you. This policy explains how to report it, what you can expect from us and how to test without causing harm. Our machine-readable contact details are published at /.well-known/security.txt.

In scope

• Our websites: plasmatic.dev and its subdomains (*.plasmatic.dev).
• The ZeroDay app: the current release downloaded from our website, including its installer, update mechanism and the services it talks to.

Examples of issues we especially want to hear about include remote code execution, privilege escalation through ZeroDay, ways to disable or tamper with ZeroDay’s protection through a flaw in the app, tampering with updates, authentication or authorisation bypasses, access to other customers’ data or submissions, and escapes from our analysis sandboxes.

Out of scope

• Detection gaps, meaning malware that ZeroDay does not detect, and false positives. These are important, but they are not vulnerabilities: report them as described in section 4.
• Services run by third parties, such as our payment processor and hosting providers. Report issues in them to the provider concerned.
• Denial-of-service or load testing, and any testing that degrades the service for others.
• Social engineering, phishing or physical attacks against our staff, offices or providers.
• Reports from automated scanners that have not been verified and that show no real security impact.
• Missing security headers, cookie flags or email authentication records (such as SPF, DKIM or DMARC) without a demonstrated exploit.
• Clickjacking on pages with no sensitive actions, self-XSS, and logout cross-site request forgery.
• Software version disclosure, banner information or descriptive error messages without a demonstrated exploit.
• Issues that only affect outdated or unsupported browsers or operating systems.
• Rate limits on actions that have no security impact.

How to report

Email [email protected]. Please write in English, and send one report per vulnerability. If you need a more secure way to share sensitive details, say so in your first message and we will arrange one. Please do not report vulnerabilities through the general support address or in public channels.

What to include

• the affected product, URL or ZeroDay version, and your operating system where relevant;
• a description of the vulnerability and its potential impact;
• clear steps to reproduce it, with a proof of concept if you have one;
• any accounts or timestamps involved; and
• how you would like to be credited, if at all.

What you can expect from us

• Acknowledgement within 3 business days of receiving your report.
• Triage within 10 business days: we will confirm whether we can reproduce the issue, tell you how severe we think it is and share our expected next steps.
• Updates as we work on a fix, and confirmation when it is released.
• Coordinated disclosure. We ask you to keep the details confidential until we have released a fix or 90 days have passed since your report, whichever comes first. If we need more time for a complex issue, we will explain why and agree a date with you. We are happy for you to publish your findings once the issue is fixed.

Rules for testing

• Only test against accounts and devices that you own or have explicit permission to test.
• Do not access, change or delete data that is not yours. If you come across personal data, customer content or credentials, stop, do not keep a copy, and tell us straight away.
• Use the minimum testing needed to demonstrate the issue, and do not use it to pivot to other systems.
• Do not run high-volume automated scans, and do not do anything that degrades the service for others.
• Do not use a vulnerability for any purpose other than verifying and reporting it.

Safe harbour

If you make a good-faith effort to follow this policy, we will:

• consider your research to be authorised, and not pursue or support legal action against you for it, including under computer misuse and anti-circumvention laws;
• waive the restrictions in our Terms of Service, ZeroDay EULA and Acceptable Use Policy, such as the restriction on reverse engineering ZeroDay, to the extent needed for that research; and
• if a third party takes legal action against you over research that complied with this policy, make it known that your research was authorised by us.

This safe harbour covers our own systems only. We cannot authorise testing of third-party systems. If you are unsure whether something is allowed, ask us at [email protected] before you go further.

Recognition

We do not currently offer payments for vulnerability reports. With your permission, we are glad to thank you publicly on this page for any valid report, using the name or handle you choose.

4. Reporting false positives and missed threats

No detection engine is perfect. If ZeroDay flagged a file you believe is safe (a false positive), or missed something harmful (a false negative), email [email protected]. Please include:

• the file’s SHA-256 hash and file name, or the URL concerned;
• the detection name or verdict you saw, if any, and when;
• the ZeroDay version;
• where the file came from, such as the official download page for a software installer; and
• for software publishers, a link to the official download so we can verify it.

If we need the file itself, we will tell you how to send it. If you send a sample, put it in a password-protected archive, so that email filters do not strip it out and nobody opens it by accident, and tell us the password in your message. Never send live malware as an ordinary attachment.

We review every report. When we confirm a mistake, we correct the detection, and ZeroDay picks up the fix automatically with its next definition update. Until then, you can restore a quarantined file from ZeroDay’s quarantine if you are confident it is safe.

5. Reporting misuse

To report misuse of our Services by someone else, such as a fake ZeroDay installer, email [email protected].

6. Contact

• Security vulnerabilities and incidents: [email protected]
• False positives, missed threats and product help: [email protected]
• Abuse of our Services: [email protected]
• Privacy questions: [email protected]

plasmatic dev