Security and responsible disclosure

We try to fix flaws before they are exploited. If you find one on this site or in our services, write to us: every report is read.

Reporting a vulnerability

Write to security@range-zero.com, from an address we can reply to.

To make the report usable, include:

• the date and time of your test,
• the steps that reproduce the problem,
• what you observed and what you expected,
• relevant logs or screenshots, without anyone else's data.

Encryption: no public key is published yet, so do not send sensitive data in the message.

A complaint about a domain scan goes to abuse@range-zero.com, described on the Our scans page.

What we ask of you

• Do not degrade the service, do not access another customer's data, and stay within the scope you are authorised to test.
• Give us a reasonable delay before publishing anything, so we can fix it.
• Do not share the details with third parties during that delay.

What we commit to

• Acknowledge your report quickly and keep you informed about the fix.
• Credit you if you wish, once the fix is deployed.
• Not pursue legal action for a test conducted in good faith under these rules.

We do not run a bounty programme at this stage.

security.txt

These contact details are also published in the standard format at /.well-known/security.txt.