Scope
In scope: domgate.com, portal.domgate.com, whois.domgate.com, the reseller API and the Domgate WHMCS module.
Out of scope: the systems of the registries, third-party services such as Cloudflare or Microsoft 365, denial of service, social engineering and physical access.
How to report
Write to [email protected]. Please include the affected address or component, the steps to reproduce the problem, its impact, and how to reach you.
Rules
- Access no data beyond what proves the problem.
- Do not modify or delete data.
- Do not disrupt the service.
- Delete any data you obtained.
- Keep the problem confidential until it is fixed.
What we commit to
- We acknowledge your report within 3 working days.
- We keep you informed of our assessment and of the fix.
- Publication is coordinated with you: you may publish your findings 90 days after your report, or earlier once the problem is fixed, if we agree.
Good-faith research
Domgate will not file a complaint or take legal action against research carried out in good faith within these rules. This commitment binds Domgate only; it cannot bind the public prosecutor.
Reporting to ANSSI instead
You may instead report a vulnerability to ANSSI, the French national cybersecurity agency, and to no one else. When a person of good faith does so, ANSSI does not have to report that person to the public prosecutor under article 40 of the Code de procédure pénale, and it keeps the reporter's identity confidential (Code de la défense, art. L2321-4). Contact: cert.ssi.gouv.fr/contact.
Rewards
Domgate does not run a bug bounty.
This policy is announced in our security.txt file.
Last updated: 12 October 2026.