Hyun Sim ↗
0x0 / SECURITY

Security is part of
the operating model.

This page documents how 0x0 handles authorization, vulnerability reports, security contacts, and access controls for research and client-authorized work.

Authorization standard ↗security.txt ↗

Security contact

Security reports concerning 0x0-owned systems should be sent to [email protected]. Reports should include the affected asset, reproduction steps, impact, and enough evidence to validate the issue without unnecessary access to third-party data.

Scope note: Contacting 0x0 does not itself grant authorization to test any system. Testing is limited to assets and methods covered by an explicit published program or written authorization.

Access control

0x0's access policy requires individually attributable accounts for sensitive systems. Shared credentials are avoided for security-sensitive workflows. Where a provider or engagement requires stronger controls, access is restricted to named users, phishing-resistant MFA, and provider-native short-lived credentials before the protected capability is used.

For any future Cyber Verification Program grant, 0x0 intends to enforce the applicable Anthropic requirements before using the granted access, including named-user attribution, phishing-resistant MFA, and short-lived native credentials.

Testing policy

  • Adversarial testing requires explicit permission from the system owner.
  • Testing is limited to the written scope and approved techniques.
  • Destructive actions, persistence, denial of service, social engineering, and access to unrelated user data are excluded unless explicitly authorized and operationally necessary.
  • Validation stops once sufficient evidence exists to demonstrate the issue safely.

Incident handling

Suspected compromise, credential exposure, misuse of privileged research access, or scope violations are treated as security incidents. Access is contained first, relevant evidence is preserved, affected parties are notified according to contractual and provider requirements, and corrective actions are documented.

Vulnerability disclosure

0x0 welcomes good-faith reports about 0x0-owned public systems. Do not access data belonging to other users, degrade availability, or expand beyond the minimum validation necessary. A dedicated disclosure policy will evolve as additional public services are launched.