If you discover a security vulnerability in ZugaShield, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email: buga@zugabot.ai

Include:

• Description of the vulnerability
• Steps to reproduce
• Impact assessment
• Suggested fix (if you have one)

• Acknowledgment: Within 48 hours
• Assessment: Within 1 week
• Fix: As soon as possible, depending on severity

The following are in scope:

• Bypass of any detection layer (prompt injection that evades Prompt Armor, etc.)
• False negatives in signature matching
• Denial of service via crafted inputs
• Information disclosure through error messages
• Vulnerabilities in the MCP server

The following are out of scope:

• False positives (these are bugs, not security issues — open a regular issue)
• Attacks that require access to the host machine
• Social engineering

We're happy to credit security researchers in our changelog and README. Let us know how you'd like to be credited.