Responsible disclosure programme

Partner with us to keep DefendDomain secure

We welcome reports from security researchers who find a vulnerability or a weakness in our platform. Tell us what you found, and we will thank you with a donation to the charity of your choice for every validated report.

Rapid acknowledgement

Expect a response within two business days and ongoing updates as remediation progresses.

Donation with every fix

Select Woodlands Trust, Cancer Research or homelessness support charities for our $25 contribution once we validate your disclosure.

Built with the security research community

We treat researchers as collaborators, keep communication transparent, and recognise how their insights harden our protection for customers around the world.

We share context on how your discoveries strengthen our domain intelligence and takedown workflows.
We provide timely updates so you know how remediation is progressing from acknowledgement to rollout.
We celebrate meaningful fixes publicly (with your permission) to highlight the positive impact of ethical hacking.

Why researchers choose DefendDomain

We work with you on each report, sort reports quickly, and give to charity for every valid one, so a good report helps our customers and a cause you choose.

Collaborative triage

Partner with our security engineers to validate findings quickly and understand the fixes that ship.

Charitable rewards

When we verify a disclosure, we donate $25 to the charity you select: Woodlands Trust, Cancer Research or homelessness support.

Clear expectations

Know exactly what information helps most so your submission stands out and our team can replicate every step.

What we're looking for

Reports should focus on issues that could impact the confidentiality, integrity, or availability of DefendDomain's platform. We particularly value discoveries that:

Demonstrate how an attacker could gain unauthorised access, escalate privileges, or tamper with monitoring results.
Reveal logic or workflow gaps that prevent critical alerts, takedown requests, or brand monitoring actions from executing correctly.
Highlight security weaknesses that could expose customer data, configuration secrets, or integration tokens.

Examples of valid disclosures

These examples are illustrative, and any impactful issue is welcome. Please avoid actions that could disrupt live customer environments while testing.

Bypassing domain alert permissions

Discovering a way to access monitoring dashboards or export data without the correct account role assignments.

Suppressed threat notifications

Identifying logic flaws that stop phishing or takedown alerts from reaching the intended recipients.

Exposed configuration metadata

Finding endpoints that reveal sensitive customer settings, API keys, or deployment information.

What doesn't qualify for a reward

To keep the programme focused on meaningful vulnerabilities, we cannot donate for best-practice reminders or non-exploitable findings.

Brute force or credential-stuffing simulations that don't demonstrate a weakness beyond password guessing.
Advisories about missing HTTP headers or TLS configuration tweaks without an accompanying exploitation scenario.
General security hardening suggestions that lack a clear, reproducible impact on confidentiality, integrity, or availability.

Submit a responsible disclosure

Use the form below to share your findings. Include reproduction steps in the message field so our engineers can verify and respond quickly.

What to include in your report

Thorough submissions help us validate and remediate quickly. When you reach out, please provide:

A concise summary describing the vulnerability or limitation.
Step-by-step reproduction instructions, including affected routes, configurations, or sample payloads.
Any evidence or screenshots that demonstrate the potential impact or data exposure.
Your preferred name (or alias) and email so we can coordinate follow-up questions.

Our triage & donation process

We aim to acknowledge submissions within two business days. After validation, we coordinate remediation updates with you and confirm the $25 donation to your chosen charity.

You'll always have a direct contact on our security team to answer questions and share progress.

Submit your security report

Share as much detail as possible, including reproduction steps, affected endpoints, and the impact you observed.