Legal · Security

Responsible
Disclosure

Security contact: security@zentrixlabs.xyz

If you have identified a security vulnerability, weakness, or concern in Zentrix Labs systems, products, or infrastructure, we want to hear from you. This page describes how to report it responsibly and what you can expect from us in response.

Our Commitment

We take security reports seriously.

Zentrix Labs is committed to handling security disclosures in good faith. If you report a vulnerability responsibly — giving us reasonable time to respond and remediate before any public disclosure — we commit to:

Acknowledge receipt of your report within 48 hours
Confirm whether the issue is within scope and provide an initial assessment within 7 days
Work with you in good faith toward remediation
Keep you informed of progress toward a fix
Credit you in any public disclosure if you would like to be credited and you request it
Not take legal action against you for responsible disclosure conducted in accordance with this policy
Scope

What is in scope.

This responsible disclosure policy covers:

The zentrixlabs.xyz website and any subdomains we operate
Any publicly accessible Zentrix Labs infrastructure
Zentrix Labs product software where a working prototype exists and you have legitimate access

What is out of scope.

Social engineering attacks against Zentrix Labs personnel
Physical attacks against Zentrix Labs facilities or hardware
Denial-of-service attacks
Issues in third-party services or infrastructure not under our control
Theoretical vulnerabilities without a working proof-of-concept
Vulnerabilities requiring physical access to hardware you do not have legitimate access to
How to Report

Send your report to security@zentrixlabs.xyz.

Please include the following in your report:

A clear description of the vulnerability and the potential impact
Step-by-step reproduction instructions
Proof-of-concept code or screenshots where applicable
Your contact details and preferred communication method
Whether you would like to be credited in any public disclosure

If the vulnerability is sensitive, you may encrypt your report using PGP. Contact us first at security@zentrixlabs.xyz to request our public key.

Please do not disclose the vulnerability publicly until we have had a reasonable opportunity to assess and remediate it. We consider 90 days a reasonable standard disclosure timeline from initial report to public disclosure, with flexibility based on the complexity of the fix required.

AI Evaluation Disclosure

Disclosures related to our AI security evaluation work.

Zentrix Labs conducts AI security evaluation through a confidential collaboration. Vulnerabilities identified during this evaluation work are reported to the relevant AI company through agreed channels before any public disclosure.

If you have information about AI model vulnerabilities and wish to discuss responsible disclosure in the context of AI security evaluation, contact us at security@zentrixlabs.xyz with the subject line "AI Security Disclosure". We will respond in confidence.

We do not facilitate or encourage any unauthorised access to AI systems. All evaluation work we conduct is performed with the explicit agreement of the AI companies whose systems we evaluate.

Safe Harbour

Good-faith researchers are protected.

Zentrix Labs will not pursue legal action against security researchers who discover and report vulnerabilities in accordance with this policy — provided that the researcher did not access data beyond what was necessary to demonstrate the vulnerability, did not perform actions that could harm Zentrix Labs or its users, and reported the issue to us before any public disclosure.

This safe harbour applies to the extent permitted by applicable Indian law. It does not extend to actions that cause harm, involve theft of data, or constitute offences under the Information Technology Act 2000 or other applicable legislation.

Security disclosure contact: security@zentrixlabs.xyz