ZeroLink is a security-focused secret sharing tool. We take vulnerability reports seriously and appreciate responsible disclosure.

DO NOT open a public GitHub issue for security vulnerabilities.

Email: security@zerolink.dev

Please include:

• Description of the vulnerability
• Steps to reproduce
• Affected component(s): frontend, backend, shared, crypto, protocol
• Impact assessment (your best estimate)
• Suggested fix (optional)

Timelines may vary depending on complexity. We will keep you informed of our progress.

We will credit reporters in the security advisory unless you prefer to remain anonymous.

• Cryptographic implementation flaws
• Key material exposure (logging, network, storage)
• Authentication or authorization bypass
• Protocol-level attacks (replay, reorder, hijack)
• XSS, CSRF, injection in the web frontend
• Server-side information leakage

• Denial of service (unless it reveals secrets)
• Social engineering
• Attacks requiring physical access to the user's device
• Vulnerabilities in third-party dependencies (please report upstream and notify us if critical)

We follow coordinated disclosure:

1. Report the vulnerability privately using the method above
2. Allow us reasonable time to investigate and fix the issue
3. We will coordinate a disclosure timeline with you
4. Do not publicly disclose before we have released a fix or agreed on a timeline

For ZeroLink's security model and threat analysis, see Security Model.