Security & Bug Bounty

Last updated: 4 August 2026

Introduction

ZOVV takes the security of our platform and the protection of our customers' data seriously. We value the work of security researchers and run a bug bounty and responsible disclosure program to encourage the reporting of vulnerabilities discovered in our systems. This policy describes what systems and types of research are covered, how to report a vulnerability to us, how we recognize and reward valid findings, and what you can expect in return.

Systems in Scope

This policy applies to the following ZOVV assets:

• The ZOVV web application and its supporting APIs.
• ZovvPay virtual card issuance, payment, and settlement services.
• Authentication, single sign-on (SSO), and multi-factor authentication (MFA) flows.
• Publicly accessible ZOVV APIs and integration endpoints.

We are particularly interested in reports covering authentication and authorization bypass, broken access controls that expose another organization's or user's data, payment and card-issuance integrity issues, server-side request forgery, injection flaws, and remote code execution.

Out of Scope

The following are not covered by this policy. Testing against them is not authorized:

• Third-party services, vendors, and payment providers integrated with ZOVV (including accommodation providers and card networks).
• Marketing sites, content pages, and any assets not owned or operated by ZOVV.
• Physical security, employees, offices, and equipment.
• Any system or account for which you do not have explicit authorization to test.

Our Commitments

When you report a vulnerability to us in good faith under this policy, we commit to:

• Acknowledge receipt of your report in a timely manner.
• Provide an estimated timeline for remediation and keep you informed of our progress.
• Work to validate and remediate confirmed vulnerabilities as quickly as is practical.
• Recognize your contribution, with your permission, once an issue is resolved.

Our Expectations

To keep research safe for our customers and for you, we ask that you:

• Report any vulnerability you discover promptly, and give us a reasonable period of at least ninety (90) days to remediate before any public disclosure.
• Test only against systems that are in scope, and only against accounts you own or are explicitly authorized to use.
• Avoid privacy violations, degradation of service, and destruction or modification of data.
• Access only the minimum amount of data necessary to demonstrate a vulnerability.
• Stop testing and notify us immediately if you encounter any user personal data, payment card data, or other sensitive information.
• Do not use automated scanners that generate significant traffic, run denial-of-service or resource-exhaustion tests, or attempt to socially engineer ZOVV staff or customers.

Official Channels

Please report security vulnerabilities to security@zovv.ai. To help us triage and resolve your report quickly, include a clear description of the vulnerability, the affected asset or URL, the steps required to reproduce it, and any proof-of-concept or supporting material. We will only communicate about your report through this official channel.

Bug Bounty & Recognition

We recognize and reward researchers who help keep ZOVV secure. Eligible rewards are determined at ZOVV's discretion based on the severity, impact, and quality of the report, and are offered for original, previously unreported, in-scope vulnerabilities that are reproducible and reported in accordance with this policy. With your permission, we are also happy to publicly acknowledge your contribution once an issue is resolved.

Where a report is submitted through one of our official channels, we will confirm eligibility and reward details during triage. If you would like to participate, please reach out at security@zovv.ai.

Out of Scope Vulnerabilities

The following issues are generally considered out of scope and, on their own, are unlikely to be eligible reports unless you can demonstrate a realistic security impact:

• Reports generated solely by automated tools or scanners without a demonstrated, exploitable impact.
• Missing security headers, cookie flags, or other best-practice recommendations without a proven exploit.
• Clickjacking on pages with no sensitive actions, and self-XSS.
• Cross-site request forgery on unauthenticated forms or forms with no sensitive action.
• Denial-of-service, rate-limiting, brute-force, and volumetric attacks.
• User or email enumeration, and reports of password, email, or account policies.
• Missing SPF, DKIM, or DMARC records.
• Software version disclosure and use of outdated or vulnerable libraries without a working proof of concept.
• Issues requiring physical access, a rooted or jailbroken device, or a compromised end-user environment.
• Vulnerabilities affecting only unsupported or end-of-life browsers, operating systems, or applications.

Safe Harbor

We consider security research and vulnerability disclosure conducted in good faith and in accordance with this policy to be authorized. We will not pursue or support legal action against you for accidental, good-faith violations of this policy, and we will work with you to understand and resolve any issue quickly. Activity that is inconsistent with this policy, or that is not conducted in good faith, is not authorized and is not covered by this safe harbor. If you are unsure whether specific testing is authorized, contact us at security@zovv.ai before proceeding.