Reporting a security vulnerability

Found a weakness in dns.lgbt? Please tell us privately first, so we can fix it before anyone misuses it.

How to report

Email kontakt@schramm.software in English or German with:

• what the problem is and where (page, address, nameserver),
• how to reproduce it,
• what an attacker could do with it.

Please don’t use the report form for this: it’s for domains that break the law or our terms. Don’t publish vulnerabilities before we’ve fixed them. Our machine-readable contact details are in security.txt.

What is in scope

• the website and app at dns.lgbt,
• the API at api.dns.lgbt, which our nameservers talk to,
• our nameservers (ns1.dns.lgbt, ns2.dns.lgbt, …) and their software,
• our proxies (proxy1.dns.lgbt, …) and our onion nodes,
• our key directory (wkd.dns.lgbt and openpgpkey.<domain> of the domains with it on),
• dns.lgbt’s own onion service (the .onion address on our front page).

Not in scope:

• the sign-in service id.schramm.software and our mail server (mail.cdev.nexus),
• the domains we host and their websites,
• the Tor relays our onion nodes run, and the Tor network itself,
• attacks on availability (denial of service, load tests), social engineering, phishing and physical attacks,
• scanner output without a way to exploit it.

What we already know

dns.lgbt doesn’t yet check that you own a domain you add. Anyone can add a domain nobody added before; if it doesn’t point to our nameservers within 24 hours, it’s removed again. No need to report this.

Rules for testing

• Test only with your own accounts and domains you own.
• Don’t access, change or delete other people’s data. If you come across it, stop, keep only what shows the problem, and tell us.
• Don’t disrupt the service: no denial of service, request floods, using our nameservers to send traffic to others, or automated scanning beyond normal use.
• Don’t try to get into our accounts, our servers or other users’ accounts, and don’t trick people.
• Give us time to fix the problem before you tell anyone else (see below).

Our promise to you

If you act in good faith and follow these rules, your research is authorised: this page is the permission our terms of service refer to for probing our servers. We won’t take legal action against you, report you to the police or close your account for it. If someone else takes action against you over research that followed these rules, we’ll make clear it was authorised.

This covers only dns.lgbt, not the systems of others or the services out of scope above.

What happens next

• We confirm your report within 3 working days.
• We tell you what we found and keep you updated until it’s fixed.
• Please wait until it’s fixed, or 90 days after your report, before you publish it. We agree on the date with you and won’t ask you to stay quiet forever.
• If you like, we thank you by name below once it’s fixed.

dns.lgbt is free and run by one person, so we can’t pay bounties.

Thank you

Nobody has reported a vulnerability yet. You could be the first.

We only list people who want to be named, with the name and link they give us, and remove them on request (see our privacy policy).