— Security

Report a security issue.

Last reviewed: September 15, 2026

If you have observed a suspected vulnerability in Headless Domains, please send us a private report. You can submit the details directly without first asking for a contact person or arranging a call.

Reporting terms

We do not operate a paid bug bounty program or offer compensation for unsolicited reports. Submitting a report does not commission services, create a payment obligation, or authorize testing.

This channel is for security findings. Sales proposals and requests to negotiate a bounty may receive no response.

What to include

The exact affected URL or endpoint and a short description.
Steps to reproduce based on observations already collected, with expected and actual behavior.
The concrete impact: what could an attacker access, change, or disrupt?
Redacted evidence, the date observed, and whether you were signed out or using your own account.

Use the subject prefix [Security report]. Our form accepts up to 5,000 characters; start with a concise report. Do not include passwords, access tokens, private keys, or other people's data. If more sensitive evidence is needed, ask us to arrange an appropriate way to share it.

Submit a security report

Scope and testing

This process covers suspected issues in the website and services operated by Headless Domains. Customer-operated domains and websites, and services operated by third parties, are outside this process. Contact their operators directly.

We welcome reports of issues you have already observed. Obtain explicit written authorization before additional security testing. Do not access other users' accounts or data, alter or delete data, disrupt services, perform social engineering, or run automated scans without authorization.

If you unexpectedly encounter sensitive data, stop and report the location with minimal redacted evidence. Please keep vulnerability details private while we assess the report and coordinate any fix.

How we review reports

Reports are received privately through our contact form. We prioritize reproducible findings with a clear security impact and may ask for clarification. We do not guarantee a response or resolution time.

Missing security headers, software version disclosures, and automated scanner results do not by themselves demonstrate an exploitable vulnerability. Include the affected behavior and practical impact so we can assess the risk. General hardening suggestions may be considered without individual follow-up.

For account help or ordinary product bugs, use our general contact form.