Service policy · Last updated 2026-09-25
Vulnerability Disclosure Policy
Hubzoid welcomes reports of security vulnerabilities from researchers, customers and the open-source community. This policy explains what is in scope, how to report an issue, how we protect good-faith research and what you can expect from us.
Section 01
Scope
The website at hubzoid.com and subdomains operated by Hubzoid.
The Hubzoid open-source software in the repository at https://github.com/hubzoid/hubzoid, including released packages and container images built from it.
Infrastructure that Hubzoid operates to provide implementation services, including the systems we use to build, test and deploy customer agents.
Section 02
Out of scope
Deployments operated by customers or other organizations. Report issues in a specific deployment to the organization that operates it. If the issue is in the Hubzoid software itself, report it to us.
Services operated by third parties, such as our hosting, analytics and email providers, GitHub and model providers. Report those issues to the provider.
Denial-of-service testing, social engineering, phishing and physical attacks.
Findings without a demonstrated security impact, such as missing security headers or cookie flags, disclosure of software versions, clickjacking on pages without sensitive actions, email authentication settings such as SPF, DKIM or DMARC, and unvalidated output from automated scanners.
Section 03
Testing guidelines
Test the open-source software on an installation you own. Do not test against deployments operated by others.
Use only accounts and data that you own or have permission to use. Do not access, change or delete other people's data.
If you encounter personal data, credentials or other sensitive information, stop, do not keep or share it, and tell us in your report.
Do only what is needed to demonstrate the issue. Avoid actions that could degrade the website or our services, and do not run high-volume automated scans against hubzoid.com.
Delete any data you obtained during testing once we confirm that the issue is resolved.
Section 04
How to report
Email security@hubzoid.com. For the open-source software, you can also use private vulnerability reporting on GitHub by opening the Security tab of the repository and selecting Report a vulnerability.
Please do not report vulnerabilities through public issues, discussions or social media.
Section 05
What to include
A clear description of the issue and its potential impact.
The affected URL, component or version. For the software, include the output of hubzoid version and, where relevant, the output of hubzoid doctor with secrets removed.
Step-by-step instructions to reproduce the issue, with any proof-of-concept code, screenshots or requests.
How we can contact you and how you would like to be credited, if at all.
Include only the minimum personal data and secrets needed to demonstrate the issue.
Section 06
Safe harbor
We consider security research carried out in good faith and in line with this policy to be authorized. We will not pursue legal action or report you to law enforcement for such research, and we will not bring claims against you for accidental, good-faith breaches of this policy.
Good faith means that you avoid privacy violations, data destruction and service disruption, access no more data than needed to demonstrate the issue, report promptly and give us a reasonable opportunity to fix the issue before disclosing it.
If a third party takes legal action against you for activity that followed this policy, we will make it known that your research was authorized by Hubzoid. This safe harbor covers Hubzoid systems only and cannot authorize testing of services operated by others. If you are unsure whether an activity is covered, ask us at security@hubzoid.com before you proceed.
Section 07
What to expect
Our response targets are as follows.
Acknowledgment of your report within five business days.
Triage and severity assessment within ten business days.
A fix for critical issues within thirty days. Less severe issues are scheduled into the regular release cycle.
We will keep you informed of our progress and tell you when the issue is fixed.
Section 08
Coordinated disclosure
Please keep details of the issue confidential until we have released a fix and agreed a disclosure date with you. Fixes to the open-source software are published in a new release, with a description of the issue in the release notes. We notify implementation services customers whose deployments are affected.
Section 09
Recognition
With your permission, we credit you in the release notes for the fix. Hubzoid does not offer payment for reports under this policy.
Section 10
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last updated.