1. Report a vulnerability
Report vulnerabilities affecting Zenith Hosting to [email protected]. Start with a brief summary of the issue and the affected service.
Our contact details are also published in security.txt.
2. Scope and eligibility
This program covers vulnerabilities in the Zenith platform and its infrastructure. Reports must demonstrate a security impact on Zenith or a failure of the isolation between customers.
Remote code execution and container isolation
For this program, remote code execution (RCE) means code execution on the underlying host system or other infrastructure outside a customer container. Code execution inside a container is not host-level RCE and is ineligible on its own. It is eligible only when chained with a separate vulnerability to escape isolation or access other customers' environments.
Software deployed in customer containers
A vulnerability in software deployed inside a customer container is not eligible unless it forms part of an exploit chain that reaches the underlying host. Report vulnerabilities in that software to the appropriate vendor or project maintainers.
3. Upstream vulnerabilities
An upstream vulnerability originates in a third-party project itself, such as gVisor or Kubernetes. Issues caused by Zenith's configuration, integration or deployment of those components should be reported to us.
Report upstream vulnerabilities through the affected project's security reporting channel and coordinate remediation with its security team before notifying Zenith. If you then report an impact on Zenith, explain how our environment is affected and include the upstream report reference when you can share it.
4. Report requirements
Reports must be actionable and original. Submissions generated automatically using large language models (LLMs) are acceptable only if they include a clear, reproducible proof of concept (PoC) and demonstrate understanding of the attack in our specific testing environment. Generic scanner output or an unverified generated explanation is not sufficient.
After arranging a secure way to share details, include:
- The affected service, endpoint and relevant software versions.
- Any prerequisites, including account permissions and the setup of your test environment.
- Reproducible steps and a minimal PoC, with relevant requests, responses or logs.
- The observed result, expected behaviour and demonstrated security impact. For an exploit chain, explain each step and the isolation boundary it crosses.
5. Testing and coordinated disclosure
Use accounts, deployments and data you control to demonstrate the issue. Do not access or change another customer's data, disrupt services or continue exploitation after establishing the impact. If you encounter another customer's data, stop and report what happened without copying or sharing it.
Keep vulnerability details private while we assess the report and coordinate remediation. Contact us to agree on public disclosure, including any disclosure coordinated with an upstream project.