A direct path for vulnerability reports

ZKAuth now provides one documented HTTPS route for responsible vulnerability reports. Reports go to a private operator destination without exposing its delivery address in the browser.

The form rejects oversized or malformed requests, applies CSRF checks and bounded rate limits, and returns public-safe errors when delivery is unavailable.

The intake accepts a deliberately small report contract instead of arbitrary uploads or rich document content. It validates required fields, limits request and field sizes, requires same-origin form submission, and applies bounded network and reporter limits before delivery.

Those checks reduce obvious abuse without claiming to identify every malicious report. They protect the public intake while keeping the security team reachable through one documented route.

If validation or private delivery fails, the route returns a public-safe response and does not expose the operator destination, provider configuration, or internal delivery error. A failed delivery is not presented to the reporter as a successful submission.

The report form and disclosure policy are public. The branded security email address remains unadvertised until inbound DNS routing is configured and tested.