Found a vulnerability? Thank you.

Updated 20 October 2026

We test other people’s systems, so we have to accept that others test ours. If you think you have found a vulnerability in a rootzero product (SpectrAI, DataShield, MailSentinel, BreachScan) or on this site, write to us.

How to report

Send an email to security@rootzero.eu with:

the affected product or URL;
a description of the vulnerability and its potential impact;
reproduction steps and evidence (requests, responses, screenshots);
your contact details if you would like a reply or a credit.

Our security.txt file (RFC 9116) carries the same information.

Our commitments

Acknowledge your report and keep you informed while we handle it.
Take no legal action against research carried out in good faith and within the rules below.
Fix within a time frame proportionate to severity, and tell you when it is done.
Credit you publicly if you wish.

Good-faith rules

Only test your own accounts and data; do not access other users’ data beyond what is strictly needed to demonstrate the issue.
No denial of service, social engineering, physical testing or spam.
Do not modify or delete any data; stop as soon as you have the proof.
Give us a reasonable time to fix before any publication.

Out of scope

Systems belonging to our customers, which are not ours.
Third-party services we use (hosting, email): report those to their vendor.
Findings without demonstrated impact: a single missing header, a displayed software version, clickjacking on a page with no sensitive action.

Report abuse

Traffic or messages from our infrastructure that look abusive (unsolicited scanning, spam)? Write to abuse@rootzero.eu with the source IP address, the timestamp and its time zone, and a log excerpt.

Legal framework

In France, you can report a vulnerability to ANSSI, which keeps the identity of the reporter confidential (article L. 2321-4 of the Defence Code). You may choose that route if you prefer.