Vulnerability Disclosure

We welcome good-faith security research that helps protect Kozo users and the prompts and schemas they keep with us. This policy explains what is in scope, how to report a finding and what to avoid while testing.

If you follow this policy, make a good-faith effort to avoid privacy violations and do not disrupt the Service, Jishu Labs LLC will not take legal action against you for the research described in your report.

• The Kozo web application at kozo.jishulabs.com
• Authentication, authorization and account isolation issues
• Exposure of secrets, prompts or generated schemas
• Server-side request handling, API validation and data access control
• Cross-site scripting, cross-site request forgery and injection

• Denial-of-service, load testing or resource exhaustion
• Social engineering, phishing or physical attacks
• Reports based only on missing security headers without a practical exploit
• Automated scanner output without analysis or a reproducible impact
• Issues in third-party services that do not affect Kozo directly

Email admin@jishulabs.com with “Security” in the subject, or use the contact page. Include enough detail for us to reproduce and triage the issue:

• The affected URL, endpoint or feature
• Steps to reproduce, a proof of concept and the expected impact
• The account email used for testing, if any
• Logs, screenshots or timestamps that help confirm the issue

We aim to acknowledge valid reports within five business days, triage them by severity and keep you updated as we fix them. Please wait to disclose publicly until we have confirmed and fixed the issue, unless we agree otherwise in writing.