Security Report

If you have discovered a security vulnerability in one of our projects or services, and you would like to report it to us, you can send an encrypted message to our Security Entry Point at security@dns-oarc.net. We do not pay out bug bounties.

To encrypt your message, use software that supports the OpenPGP standard. Our key can be found below.

Please allow us a reasonable time-frame to formulate a response and do not send security issues to public lists. If desired, we will fully credit the reporter.

Scope and rewards

If you have a bug report without security impact, please use the public issue tracking available for each project. Any other feedback can be sent to us via email, see our contact page.

We are a non-profit organization and while we welcome any reports of vulnerabilities for our software or services, we do not offer any monetary compensation for your report, nor do we offer a bug bounty program. We do credit reporters when applicable.

OpenPGP key

The OpenPGP key can be downloaded or copied from below. Please remember to make your key available to use for a timely response.

 
Fingerprint: 699B C7EB 56C7 A8DD BEAB  D4F7 557C E822 BEF8 DA06
User ID: DNS-OARC's Security Entry Point <security@dns-oarc.net>
 

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEasyRxBYJKwYBBAHaRw8BAQdAyegB5/2oEYGqIiKkH+mDO1Ug+h7tvpc1K/lV
9XumZIS0N0ROUy1PQVJDJ3MgU2VjdXJpdHkgRW50cnkgUG9pbnQgPHNlY3VyaXR5
QGRucy1vYXJjLm5ldD6IlgQTFggAPgIbAwULCQgHAwUVCgkICwUWAwIBAAIeBQIX
gBYhBGmbx+tWx6jdvqvU91V86CK++NoGBQJqzJMUBQkSzARQAAoJEFV86CK++NoG
6d0BAIfXg+tmxZ7VipbqO+rFpUvSxsWN5pUBkbd7o6/3ldSlAQChkXPUXzJI/xMx
2zX2w6OTVBBwJL/4pTbNiI0bB5feCLg4BGrMkcQSCisGAQQBl1UBBQEBB0AYe/r7
/14JBOjQ26aWEJ2nR1wfJrvJlj2VtVvSksz5FwMBCAeIfgQYFggAJgIbDBYhBGmb
x+tWx6jdvqvU91V86CK++NoGBQJqzJLOBQkSzAQKAAoJEFV86CK++NoG/ysBAOgz
BZJNMHcAzMGqtjbyluf6wuf+xNRX8NkXpUlRC0sSAQCxwreHIGXuxNjQ8Un73V2y
XwivAmKLSdGBRMmfvgi1Dg==
=UtsA
-----END PGP PUBLIC KEY BLOCK-----