Security & Responsible Disclosure

How we protect our systems

• HTTPS everywhere, with strict security headers.
• Hosting, database and storage on Google Cloud / Firebase, encrypted at rest.
• Access rules that limit every user to their own records; administrator access is restricted and signed in.
• Payments handled by a payment provider; we never store card, UPI or bank details.

Report a vulnerability

If you believe you have found a security vulnerability in domainhostly.com or one of our services, please email support@domainhostly.com with "Security" in the subject. Include the affected page or system, the steps to reproduce it and what an attacker could do.

We will acknowledge your report within 3 working days, keep you updated, and credit you on request once it is fixed.

Please

• Test only against your own account and data, and stop as soon as you have shown the problem.
• Do not access, change or delete other people's data, and do not run denial-of-service, spam or social-engineering tests.
• Give us reasonable time to fix the issue before telling anyone else.

If you follow these rules in good faith, we will not take legal action against you for your research.

security.txt

Our contact details are also published at https://domainhostly.com/.well-known/security.txt.