SECURITY

Found a flaw? Tell us.

For researchers and for anyone who found something by chance · also at zafe.pt/.well-known/security.txt

01How to report

Write to seguranca@zafe.pt or use the form. Tell us what you found, where (address or part of the product), the steps to repeat it and the impact you think it has. You don't have to say who you are, but without an email we can't reply to you.

Send a report seguranca@zafe.pt
It reaches only the Round2 security team.

02What you can test

  • The zafe.pt website and the seal verification page.
  • The console (consola.zafe.pt) and the client dashboard (painel.zafe.pt), without trying to get into accounts that aren't yours.
  • The API (api.zafe.pt) and the Zafe agent for Windows.
  • The Zafe assistant on WhatsApp.

03What's out of scope

  • Our clients' companies. Never test them without their authorisation: that's no longer research.
  • Attacks that take the service down, or mass sending.
  • Deceiving people at Round2 or at clients (phishing, phone calls) and physical access.
  • Automated tool reports with no proof that the flaw exists.

04Good-faith rules

  • Do only what's needed to prove the flaw.
  • Don't access, change or delete data that isn't yours. If you come across someone's data, stop and tell us.
  • Don't use the flaw beyond the proof, or keep it for later.
  • Give us time to fix it before you make it public. We'll agree the date with you.

05What we do

  • We confirm receipt of your report within 2 working days.
  • We tell you what we concluded and when the fix is done.
  • We take no action against anyone who respects these good-faith rules.
  • If you wish, we add your name to the thank-you list.

06Rewards

We don't have a cash reward programme yet. We thank you publicly, if you wish, and we reply to every report.