Reporting a vulnerability

How to reach us

Use the report form with the security box ticked, or email bugs@domainless.fun. Both land with the same two people. Reports marked as security are held private permanently — they can't be published from our own tools, and they never appear on the status page.

Please include enough for us to reproduce it: what you did, what you saw, and which part of the platform. If you have a proof of concept, describe it rather than running it against other people's accounts.

What we promise

• We'll acknowledge you within 5 working days, from a human, not a robot.
• We'll tell you what we're doing about it — including if we decide not to fix it, and why.
• We won't pursue you for good-faith research that follows this page. See the safe harbour below.
• We'll credit you on our status page when the fix ships, if you'd like us to and it's safe to do so. Say the word and we'll keep you anonymous instead.

What we ask

• Give us a reasonable window to fix it before you discuss it publicly. Ninety days is our default; if it's actively being exploited, tell us and we'll move faster together.
• Use your own accounts. Don't access, modify or keep anyone else's data. If you stumble into someone's data, stop, and tell us what you saw so we can measure the exposure.
• Take no more than you need to prove the issue — one record, not the table.
• Don't degrade the service: no denial-of-service, no load testing, no spam or mass automated scanning against production.
• No social engineering of our people, our users, or our suppliers, and no physical attacks.

Safe harbour

If you follow this page in good faith, we will treat your research as authorised. We won't bring a claim against you, we won't ask anyone else to, and if a third party comes after you over research that stayed within these rules, we'll make it clear publicly that you had our permission. If you're unsure whether something is in scope, ask first — we'd much rather answer a question than receive an apology.

This is a promise about how we'll behave. It isn't legal advice, and it can't bind anyone but us.

Scope

In scope: domainless.fun and its apps, jandgstudios.fun, and our mail infrastructure at mail.domainless.fun.

Out of scope, because they aren't ours to authorise or aren't defects we can act on:

• Third-party services we merely link to or embed.
• Findings that are only a missing hardening header, a version banner, or a scanner's default output, with no demonstrated impact.
• Anything requiring a rooted or physically compromised device, or a victim who's already been phished.
• Self-XSS, clickjacking on pages with no state-changing action, and reports auto-generated by a tool with no human review.

Is there a bounty?

We don't run a paid bounty programme. We're a two-person studio and we'd rather promise something we can keep than advertise a reward we can't. What you get is a fast human response, honest updates, public credit if you want it, and our word on the safe harbour above.

Reporting something that isn't a security issue

Ordinary bugs — things that are broken, ugly, or confusing — go to the bug report form. Those are just as welcome; they're simply handled in the open rather than under embargo.