NIMBUS
A confidential red team model for authorized work.
▾▴▾ ZUNFTMAX / 001Offense & defense, under seal
Advanced
Persistent
Defense.
NIMBUS tests the line. HALO holds it.
Access begins with a conversation.
Inside ZUNFTMAX 01 / 02
Further details are shared with qualified teams.
Built for the work that stays unseen.PRIVATE ACCESS · 2026
▾▴▾ THE PAIR01 / 02
Two systems.
One seal.
Access by introduction ↗
HALO
A policy gateway for agent traffic.
NIMBUS IS IN DEVELOPMENT · SHARED SELECTIVELY
▾▴▾ ZUNFTMAX / SERVICESAUTHORIZED WORK
Find the fault.
Leave the guardrail.
01
Adversarial review
Authorized testing across agent loops, model interfaces, and the software beneath them. Findings come with a path to reproduce, a root cause, and a fix to test.
02
Security engineering
Build controls against the failure we found: authorization gates, trace lineage, verification harnesses, and CI checks your team can keep running.
03
Confidential infrastructure
Threat models, attestation, and deployment design for protected workloads. We mark the boundary between verified evidence and unfinished hardware paths.
▾▴▾ ZUNFTMAX / TRUSTARCHITECTURE / IN PROGRESS
DESIGN NOTES / 001Boundaries
Boundaries
before belief.
Security claims should have edges you can inspect.
Permission is explicit.
Offensive work begins with a defined, authorized scope.
Confidential by design.
The red team model is being developed around protected execution.
Every path has a rule.
Agent traffic passes through a policy gateway.
DESIGN INTENT / NOT A CERTIFICATION
▾▴▾ ZUNFTMAX / ACCESSBy introduction
Start a
conversation.
Tell us where to reach you. We’ll take it from there.
▾▴▾ SECURITY / DISCLOSUREPRIVATE REPORTING
Report a vulnerability.
If you believe you have found a security vulnerability in ZUNFTMAX, NIMBUS, HALO or the ZUNFTMAX browser, report it to us privately. This page explains what to send, how we will communicate with you, and when.
01
What to include
Send as much of the following as you can. Reports with clear reproduction steps are triaged first.
Product & versionAffected product, version or build number, and platform / OS.
DescriptionThe vulnerability type and its impact on confidentiality, integrity or availability.
ReproductionStep-by-step instructions, proof-of-concept code, request/response logs or screenshots.
EnvironmentConfiguration, browser or extension settings, and any non-default options needed.
DiscoveryWhether the issue is known publicly or being exploited, to your knowledge.
ContactHow to reach you, and the name or handle to credit (or a request to stay anonymous).
02
How we communicate
One named member of our security team is your point of contact from first acknowledgement to disclosure.
AcknowledgementWithin 2 business days of your report.
Initial assessmentWithin 5 business days: validity, severity (CVSS) and next steps.
Status updatesAt least every 7 days until the issue is resolved, and whenever status changes.
Fix & releaseWe confirm the fixed version and release date before publishing.
DisclosureCoordinated. We target public disclosure within 90 days of the report, agreed with you in advance.
03
What we ask of you
Give us reasonable time to fix the issue before disclosing it. Do not access, modify or delete data that is not yours, degrade our services, or use social engineering or physical attacks.
Good-faith research that follows this policy will not be pursued legally, and we will credit you in the advisory unless you ask us not to.
04
Advisories
For current Chromium security fixes, read the Chrome team’s original advisories.
zunftmax.secure.build/security/cves →▾▴▾ SECURITY / UPSTREAMCHROMIUM
Read the
source.
Chromium advisories are published by the Chrome team. Read the original release notes for current security fixes.
Chrome Releases ↗