Responsible Disclosure

At a glance

• Report privately to support with Security — suspected vulnerability in the subject.
• Use only authorized accounts and synthetic examples.
• Stop testing if you encounter another person's private information.

Report privately

Email support@zionelchurchapp.com with the subject Security — suspected vulnerability. Describe the affected feature or sanitized URL, likely impact, approximate time and minimal reproduction using your own authorized account and synthetic data. Include a redacted screenshot only if helpful. A church administrator's permission is not required to report a Zionel issue.

Do not send passwords, tokens, database addresses with credentials, authentication codes or another person's private information. If your evidence contains sensitive data, describe its existence without attaching it and ask for a suitable secure handling route.

Protect people while reporting

• Do not access another person's or church's records, extract data or keep testing after encountering private information.
• Do not disrupt service, use social engineering, send spam, introduce malware or bypass authorization to demonstrate impact.
• Do not publish sensitive details or privately obtained records before coordinated handling.
• Use only accounts, systems and test data you are explicitly authorized to use. A report or this page is not permission for a penetration test.

Review and coordination

Zionel reviews reports through its support and security routes. Coordinate additional evidence and disclosure through your report contact. This policy does not create a bug bounty, legal safe harbor or authorization to test systems without permission.

If an issue is urgent, explain the impact without including confidential records. This channel is not an emergency service and does not provide a fixed acknowledgment or remediation deadline.