Security and disclosure
Zeus handles downloads and, with consent, website sessions. If you find a weakness, we want to hear about it first.
How to report
Email info@vernesystems.com with the subject line starting SECURITY:. Please include what you found, the affected component and version or commit, steps to reproduce, the impact you expect, and how you would like to be credited. Do not include real credentials or other people’s data. GitHub’s private vulnerability reporting is not switched on for the repositories, so email is the way to report for now.
Scope
- The Zeus app: daemon (zeusd), command line, MCP server and native-messaging host.
- The zeus-core engine library.
- The Zeus browser extension for Chrome and Edge.
- This website and its machine-readable files.
Out of scope: volumetric denial-of-service, social engineering of Verne staff, physical attacks, findings that require a compromised device or browser, and reports produced only by automated scanners without a demonstrated issue.
What we care about most
- Any way for an AI agent, a web page or another program to approve a request, create or extend a permission, or obtain session cookies.
- Cookies, tokens or signed-link secrets reaching disk, logs, audit records, error messages or an AI assistant.
- Writing outside allowed folders, overwriting files or executing downloaded content.
- Impersonating the extension or the native host, or abusing the native-messaging channel.
- Corrupting the journal so that Zeus believes it has bytes it does not have.
What we commit to
- Acknowledge your report within 3 business days.
- Give an initial assessment within 10 business days and keep you informed.
- Fix confirmed issues as fast as their severity requires, and coordinate disclosure with you. Our default disclosure window is 90 days.
- Credit you in the advisory if you wish.
We do not currently run a paid bug bounty.
Safe harbour
We will not pursue legal action against good-faith research that follows this policy: test only against your own installations and accounts, avoid privacy violations and service disruption, do not access or keep other people’s data, and give us reasonable time to fix an issue before disclosing it.
Security by design
Zeus’s specifications include a threat model and testable security invariants. Approvals are bound to the facts they show and can only come from a person on a trust surface; the daemon has a single local connection point and no network listener; secrets are held in zeroising memory and never serialised; and the extension has no content scripts and loads no remote code.