We take the security of our websites and products seriously. If you believe you have found a vulnerability in zagrosian.com, Hevalo or any other Zagrosian service, we want to hear from you, and we will work with you to fix it.

How to report

Email contact@zagrosian.com with “Security” in the subject line. Please include:

a description of the vulnerability and where you found it;
the steps needed to reproduce it, with a proof of concept if possible;
its potential impact, as you understand it;
how we can reach you for follow-up.

Our security.txt file lists the same contact details in a machine-readable format.

What we ask of you

Report the vulnerability as soon as possible after you find it.
Do not access, change or delete data that does not belong to you. Access only as much as you need to demonstrate the issue.
Do not use denial-of-service attacks, social engineering, phishing, spam or physical attacks.
Do not install malware or backdoors, or make lasting changes to our systems.
Keep the vulnerability confidential until we have fixed it, and give us reasonable time to do so.

What we will do

Acknowledge your report within five working days.
Keep you informed of our progress towards a fix.
Treat your report confidentially and not share your personal details without your permission.
Credit you for the discovery once the issue is resolved, if you would like us to.

If you act in good faith and follow this policy, we will not take legal action against you in relation to your report. We do not currently offer financial rewards.

Out of scope

Findings from automated scanners without a demonstrated security impact.
Vulnerabilities in third-party services we use, such as Cloudflare. Please report these to the provider concerned.
Social engineering of our team or partners.