Vulnerability Disclosure Policy

1. Introduction

BLUE ZEBRA LABS, S.L. · Tax ID (NIF) B88890629
C/ Saragossa, 95, ent. pta. 3 · 08006 Barcelona (Spain)
Contact: legal@bluezebralabs.com

The security of our customers' data — and of their own customers' data — is a priority. This policy gives security researchers instructions for conducting good-faith vulnerability discovery activities and explains how to report discovered vulnerabilities to us: which systems are covered, which types of testing are permitted, and how to send us reports.

2. Guidelines

We request that you:

• Notify us as soon as possible after you discover a real or potential security issue.
• Give us a reasonable amount of time to resolve the issue before you disclose it publicly.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Only use exploits to the extent necessary to confirm a vulnerability's presence. Do not use an exploit to compromise or exfiltrate data, establish persistent access, or pivot to other systems.
• If you establish that a vulnerability exists or encounter any sensitive data (including personal data, financial information, or trade secrets of any party), stop your test, notify us immediately, and keep the data strictly confidential.
• Do not submit a high volume of low-quality reports.

3. Authorization

Security research carried out in accordance with this policy is considered authorized. We will work with you to swiftly understand and fix the problem, and Blue Zebra Labs, S.L. will not recommend or pursue legal action in connection with research that complies with this policy.

4. Scope

This policy applies to the following systems:

• www.bluezebralabs.com (public website)
• portal.bluezebralabs.com (customer portal)
• api.bluezebralabs.com (platform API)
• The BlueZebra companion mobile application
• The embeddable web chat widget served by the platform

5. Out of scope

Any system not explicitly listed above is out of scope, including our customers' own websites embedding the widget. Vulnerabilities in third-party solutions the platform integrates with should be reported directly to the corresponding vendor under their own disclosure policy. If you are unsure whether a system is in scope, email us at security@bluezebralabs.com before starting.

6. Unauthorized testing types

• Network denial-of-service (DoS or DDoS) tests.
• Physical testing (e.g., office access, open doors, tailgating), social engineering (e.g., phishing, vishing), or any other non-technical testing.
• Testing against our customers' real data or businesses.

7. Reporting a vulnerability

Send an email to security@bluezebralabs.com. Reports may be submitted anonymously. Our security.txt file (RFC 9116) publishes this same channel.

8. Desirable information

To help us process and react to your report, we recommend including:

• A description of the vulnerability
• Where it was discovered
• Potential impact
• Steps required to reproduce it (scripts and screenshots welcome)

If possible, please provide your report in English or Spanish.

9. Our commitment

If you choose to share your contact information, we promise to communicate with you in a transparent and timely manner: we will acknowledge receipt of your report within 3 business days and will keep you informed of vulnerability confirmation and remediation to the best of our capabilities. We welcome discussion of any concerns.