ZOHAR LABS
Back to homepage

Security & Trust

Discretion, least privilege, and practice that can be verified. This page sets out how Zohar Labs approaches security and how to report a vulnerability.

Security lead

Beni Saadon

Founder & Head of Security Engineering

Leads Zohar Labs' security function: defensive hardening, LLM-threat research (prompt injection, model misuse, untrusted-input exploitation of AI agents) and secure development across our products.

beni@zoharlabs.com

How we work

These are working practices, not certifications.

  • Least privilege

    People, services, and AI agents receive only the access their task requires.

  • Data minimization

    We collect and keep only the information an engagement needs. The inquiry form on this site requires only a name and an email address.

  • Encryption in transit

    This site and its inquiry form use HTTPS. The systems we build use encrypted connections between client applications and services.

  • Audit trails

    Changes to the systems we build go through version control and review, so it can be traced who changed what, and when.

  • Client material under NDA

    Client material is handled under a non-disclosure agreement and kept separate from other engagements.

  • No third-party sharing

    We do not sell client or inquiry information or share it with third parties. Infrastructure that delivers a service may process data only to provide that service.

Responsible disclosure

If you believe you have found a security vulnerability in a Zohar Labs website or product, please email the security contact. Include the affected address or component, a description of the issue, and the steps needed to reproduce it.

beni@zoharlabs.com

Please do not access, modify, or retain data that is not yours, and do not run tests that could degrade the service for others. Allow us reasonable time to investigate and remediate before any public disclosure.

We acknowledge reports within 5 business days.

Good-faith security research that follows this policy, avoids privacy violations and service disruption, and gives us reasonable time to respond will not be met with legal action by Zohar Labs.

We do not operate a bug bounty program and do not offer payment for reports.

Machine-readable contact details are published in security.txt.

Company

Zohar Labs Ltd. is a privately held company headquartered in Israel, working with clients internationally.