Security and authorization
Zulfiqaar runs real offensive tooling, so every session is authorized, scoped and watched. This page explains how, for you and for whoever approves your use of it.
How a session gets authorized
-
You declare the target
Domains, scope, and the bug bounty program, CTF or written permission you are testing under.
-
We verify the domain
Ownership or program scope is checked against what you declared.
-
An operator approves
A person reviews the authorization before any session time starts. Rejected requests are refunded.
-
Scope is enforced
The HTTP engine checks every request it sends against the approved scope.
Limits the agent can’t switch off
The scope checks are built into the HTTP engine, below the agent, so the agent has no way to turn them off. Anything risky waits for you.
- Agent Plans the next step. Anything a target returns is treated as data, never as instructions.Decides
- Your approval Destructive or out-of-band actions wait here until you approve them.Gate
- HTTP engine Every request it sends is checked against your scope and an SSRF guard. There is no option to skip the check.Gate
- Engagement record Every request and finding is saved, so you can show exactly what was tested.Records
- Target Only the scope you declared and an operator approved.In scope
Monitoring, isolation and data
- Monitoring
- Operators can watch any active session in real time and keep recordings, to confirm that testing stays within its authorization. Sessions that go beyond it are paused or ended.
- Isolation
- Each session runs in a container dedicated to your account, with its own storage. Your session is routed only through your authenticated sign-in, never through a value you can supply.
- Data retention
- Session recordings, engagement data and audit logs are kept for 180 days, then deleted or anonymized. Account data is kept while your account exists.
- Model providers
- The agent sends the prompts and tool output it needs to the AI model provider for your session. On access plans, that is the provider account you connected.
The Privacy Policy and Terms of Service have the full detail.
Reporting a vulnerability
If you find a security issue in Zulfiqaar itself, please tell us before disclosing it.
Email access@msszulfiqaar.com with the details and steps to reproduce.
Our contact details are also published in /.well-known/security.txt.
Testing Zulfiqaar's own infrastructure is not covered by any session plan. Please report, don't probe.