Namegarage
Version 2.0 Effective 2026-09-27 Current version

Vulnerability Disclosure Policy

AI summary

AI-written reading aid: an overview of this policy. The full policy below is the authoritative text.

  • Covers namegarage.com and its subdomains: all pages, forms, /api/ endpoints behind the offer, purchase, lease and referral flows, and their emails and texts.
  • Report issues to security@namegarage.com with the URL, reproduction steps and what you achieved; an OpenPGP key is published for encryption, and reports are read in English.
  • Out of scope: denial of service or load testing, social engineering, phishing, physical attacks, third-party services with their own programs, and impact-free scanner output.
  • Stop at the minimum proof needed, do not read, alter or keep others' data, and never use a flaw to make an offer or obtain a domain unpaid.
  • Hold public disclosure until the issue is fixed or 90 days after your report, whichever comes first.
  • No legal action or law-enforcement referral for good-faith research that follows these rules; reports are acknowledged within 5 business days and you are kept informed, but no bounty is paid.

This policy covers namegarage.com and its subdomains: every page, every form, and every /api/ endpoint those forms post to — the offer, direct-purchase, lease, and referral flows — and the email and text messages they send.

  • Denial of service, load testing, or anything else that degrades the site for other visitors.
  • Social engineering of the seller, of buyers, or of anyone else; phishing; physical attacks.
  • Third-party services this site relies on. Cloudflare, Escrow.com, and DocuSeal each run their own disclosure program; report a problem in their systems to them.
  • Output of automated scanners with no demonstrated impact, missing headers on pages with nothing to protect, and version banners.
  • Stop at the minimum needed to demonstrate the issue. Do not read, change, or keep data that is not yours; if you come across another person's data, stop and tell us.
  • Do not disclose the issue publicly before we have fixed it or 90 days have passed since your report, whichever comes first.
  • Do not use an issue to make an offer, complete a purchase, or obtain a domain you have not paid for.
  • We acknowledge every report within 5 business days.
  • We keep you informed of what we find and when it is fixed.
  • We will not pursue legal action against research that follows this policy in good faith, and we will not refer it to law enforcement as an attack.

This is a one-person domain portfolio, not a company with a security budget. We do not pay for reports. We do say thank you, and mean it.

Email security@namegarage.com with the affected URL, the steps to reproduce, and what you were able to do. To encrypt the report, use the OpenPGP key published at /security/pgp-key.txt, whose fingerprint is:

fc561d0a77ff466db2f59c7147db09db5de7c0b4

The same address, key, and this page's URL are published in machine-readable form at /.well-known/security.txt (RFC 9116), signed with that key. We read English.

Each version of this policy is published at a permanent dated address alongside the SHA-256 hash of its source, and every prior version stays reachable from the list at the foot of this page. A change is made by publishing a new version, never by editing a published one — so what this policy said on the day you tested remains verifiable.

Content fingerprint (SHA-256 of this version's source): de94e7740b8ae827ab2adff743cb3cd858c2d341083817a61992c730a6fee6bd

All effective dates are stated in Coordinated Universal Time (UTC).