Reporting a vulnerability

How to report

security@zetaiti.com

Write to this address, in English or Italian. Please do not put the details anywhere public — an issue, a forum, social media — before we have agreed a disclosure date with you.

What to include

• the product and its version, and where it runs (operating system, device, how it was installed);
• what the vulnerability is, and what an attacker could do with it;
• the steps to reproduce it: a proof of concept, requests, logs or screenshots;
• whether you know or suspect that it is already being exploited, or that others know of it;
• how you would like to be credited, or that you would rather not be;
• how we can reach you.

Send only what is needed to show the problem. Do not include other people's personal data or working credentials; if your test reached data that is not yours, say so, stop there and do not keep it. If you need to send something sensitive, say so in a first message without the details and we will agree a way to receive it.

What happens next

• Acknowledgement within 2 working days: a person confirms that your report arrived.
• First assessment within 5 working days: whether we can reproduce the problem, how severe we think it is, and what we will do next.
• We keep you informed while we work on a fix, and tell you when it is released.

Working days are Monday to Friday, except public holidays in Italy.

Coordinated disclosure

• Please keep the details private for 90 days from your report, or until a fix is released if that comes first. When a fix ships, we publish an advisory with it and you are free to publish too.
• If a fix needs longer than 90 days, we tell you why before the date and ask you for more time; we do not move the date without telling you.
• If a vulnerability is being actively exploited, we may warn users sooner, with what they can do to protect themselves.
• An advisory names the affected versions, the fixed version, the severity and what users should do, and credits you unless you ask us not to.

What this covers

Our products — Zetaiti Platform (the hub) with its apps for phone, watch and desktop, and Vademac — and our websites zetaiti.com and protolab.tech.

Supported versions

Security fixes are made for the latest minor release of each product: the release line X.Y with the highest number, and its patch releases X.Y.z. Older minor releases do not get fixes — update to the latest release first, and tell us if the problem is still there.

Out of scope

• on a Zetaiti Platform hub or in Vademac, what a signed-in person can do within the rights of their account or role. A way to do more than those rights allow, including through text an AI agent reads (prompt injection), is in scope;
• what an AI model says or decides by itself, unless it makes our product act beyond those rights;
• products and services of other companies that we use, link to or connect to (for example GitHub, Cloudflare, Google, Microsoft, model providers): please report to them, and tell us if our product is affected;
• a vulnerability in a third-party library without a demonstrated effect on our product (report it upstream);
• versions that no longer get fixes;
• attacks that need physical access to an unlocked device, a device that is already compromised (rooted, jailbroken, infected), or an account whose password the attacker already has;
• denial of service by volume (flooding, load tests), spam, and social engineering or phishing of our people;
• findings of automated scanners without a demonstrated impact, self-XSS, and missing headers, TLS, cookie or email (SPF, DKIM, DMARC) settings on our websites without a concrete way to exploit them.

Rewards and good faith

No bounty

We do not run a bug bounty programme and do not pay for reports. We are glad to credit you in the advisory.

Research in good faith

If you act in good faith and within this policy — you test only systems that are yours or that you may test (such as your own installation), you do not access, change or delete more data than you need to show the problem, you do not disrupt a service, and you report to us promptly and privately — we will not take legal action against you for that research.

Reports to the authorities

Under the EU Cyber Resilience Act (Regulation (EU) 2024/2847, Article 14), when we become aware of an actively exploited vulnerability in one of our products, or of a severe incident affecting its security, we notify it through ENISA's Single Reporting Platform to the CSIRT designated as coordinator (for us, CSIRT Italia) and to ENISA, within the deadlines the Regulation sets, and we inform the users affected. If your report becomes part of such a notification, we tell you, and we share only what the notification needs.

Advisories

None published yet. When a fix for a vulnerability is released, its advisory is published here, with the affected and fixed versions, the severity and what users should do.

Machine-readable contact: security.txt (RFC 9116).