Security

If you think you have found a weakness in zikvi.com, tell us privately and give us time to fix it. This page was last updated on 23 October 2026.

Where this applies

It covers zikvi.com and the pages we publish on that domain. Email info@zikvi.com with the subject line “Security report”. We aim to acknowledge a report within 5 business days. Research done in good faith, and within the rules below, will not be treated as unauthorised access, as long as you do not harm visitors or the service.

What to send

• A weakness that lets someone run a script, inject a query, or reach data they should not.
• A flaw in sign-in, a session, or who is allowed to see a page.
• A server setup that exposes information that should stay private.

What is outside this page

• Flooding the site or load-testing the live service.
• Phishing, social engineering, or a physical attempt to get in.
• A problem that belongs to a payment company, a host, or an email provider.
• A missing header that you have not shown can be exploited.
• A copyright question about a design. Use the contact page.
• An order or a refund. Use the returns page.

How to test

• Do not open, change, or delete data that is not yours.
• Do not use a real customer's account unless we have agreed in writing.
• Stop once you can show the issue. Use the smallest test that proves it.
• Do not publish the details until we have had a reasonable time to fix it, usually 90 days.
• Do not collect personal data from the site.

In the email, describe the impact, the steps to reproduce it, and how we can reply to you. There is no paid bounty. We may thank you publicly after a fix if you agree. A short contact file for researchers is at /.well-known/security.txt.