Vulnerability Disclosure Policy

In short. If you find a security problem on this site, tell us at security@namegarage.com, give us a reasonable time to fix it, and we will not take legal action against you for research that follows this policy. There is no paid bounty.

1. Scope

This policy covers namegarage.com and its subdomains: every page, every form, and every /api/ endpoint those forms post to — the offer, direct-purchase, lease, and referral flows — and the email and text messages they send.

2. Out of scope

• Denial of service, load testing, or anything else that degrades the site for other visitors.
• Social engineering of the seller, of buyers, or of anyone else; phishing; physical attacks.
• Third-party services this site relies on. Cloudflare, Escrow.com, and DocuSeal each run their own disclosure program; report a problem in their systems to them.
• Output of automated scanners with no demonstrated impact, missing headers on pages with nothing to protect, and version banners.

3. Rules of engagement

• Stop at the minimum needed to demonstrate the issue. Do not read, change, or keep data that is not yours; if you come across another person's data, stop and tell us.
• Do not disclose the issue publicly before we have fixed it or 90 days have passed since your report, whichever comes first.
• Do not use an issue to make an offer, complete a purchase, or obtain a domain you have not paid for.

4. What we commit to

• We acknowledge every report within 5 business days.
• We keep you informed of what we find and when it is fixed.
• We will not pursue legal action against research that follows this policy in good faith, and we will not refer it to law enforcement as an attack.

5. No bounty

This is a one-person domain portfolio, not a company with a security budget. We do not pay for reports. We do say thank you, and mean it.

6. How to report

Email security@namegarage.com with the affected URL, the steps to reproduce, and what you were able to do. To encrypt the report, use the OpenPGP key published at /security/pgp-key.txt, whose fingerprint is:

fc561d0a77ff466db2f59c7147db09db5de7c0b4

The same address, key, and this page's URL are published in machine-readable form at /.well-known/security.txt (RFC 9116), signed with that key. We read English.

7. Changes to this policy

Each version of this policy is published at a permanent dated address alongside the SHA-256 hash of its source, and every prior version stays reachable from the list at the foot of this page. A change is made by publishing a new version, never by editing a published one — so what this policy said on the day you tested remains verifiable.