Reporting a vulnerability

Email hung@z-zero.xyz with [security] in the subject. Include the steps to reproduce, the URL or package version, and what an attacker gains. We reply within 3 business days and keep you updated until it is fixed.

• The web app and API at z-zero.xyz, including /api/* and the agent surfaces (/agent.md, /llms.txt, /.well-known/agent.json).
• The z-zero-mcp-server package on npm and its public source on GitHub.

The MCP server is open source — reading the code is the safest way to look for problems, and needs no money at all.

• Our providers' own systems — the card issuer and the card networks, Coinbase CDP, Supabase, Vercel, Base. Report those to them.
• Denial of service, load or volume testing, and high-rate automated scanning.
• Phishing, social engineering, or anything physical.
• Findings that need a device already under the attacker's control.

• Test with your own account, your own Passport Key and your own funds. Keep amounts to the minimum that proves the point.
• Do not access, change or delete another user's data. Stop at proof and tell us.
• Never move or keep money you do not own. If a bug pays you, report it and send it back.
• Keep automated traffic low — a challenge page triggered by a scanner also blocks the real agents that use this site.
• Give us 90 days to fix before you publish, or less if we agree it is fixed.

If you act in good faith and follow the rules above, we will not pursue legal action or ask anyone else to, and we will credit you publicly once the fix ships — or keep your name out of it, as you prefer. There is no paid bounty programme yet; we will say so here when there is.