What this channel is for.
Report a potential security flaw in a Zovvi channel or service, such as unauthorized access, exposed information or a failure of isolation. Visual errors belong in Report a bug; third-party misuse belongs in Report abuse.
Limits before any testing.
This channel does not authorize active testing or access to other customers’ accounts or third-party systems. Confirm scope and authorization before testing. Do not perform denial of service, brute force, social engineering, data extraction or destructive changes.
Demonstrate only what is necessary.
Include the location, context, prerequisites, minimal steps and the difference between expected and observed behavior. Describe the impact without accessing more data. Redact personal information, tokens, cookies, credentials and recovery codes. Do not paste executable payloads or other people’s complete data.
Following up on your report.
Keep the reference shown after receipt. Our team may request clarification and assess a safe way to reproduce the issue. Coordinate disclosure of technical details before publishing them. Submission does not carry an automatic deadline or reward.
Common questions.
Must I exploit a vulnerability to report it?
No. Describe what you observed and why it may present a risk. Stop if data is exposed or harm could occur. Our team can guide the next steps needed for assessment.
Can I attach sensitive files?
This form accepts text and does not accept attachments. Describe minimal evidence with sensitive details redacted. If an additional file is needed, agree on an appropriate sharing method first.
Further references.
Official guidance for exploring these practices further.