Reporting a security problem
Domani takes card payments and keeps accounts, so we want to hear about any security problem you find in it. Write to info@domani.jobs and tell us what you found, the steps to reproduce it, and what someone could do with it. We reply within 5 business days.
What we ask
Give us time to fix the problem before you publish anything about it. We agree on a date with you and tell you if it moves.
Test with your own account and your own data. If you reach another person's data, stop there, and do not keep, share or change it.
Do not run denial-of-service tests or anything else that slows the site for the people using it. Do not try phishing or other social engineering on us, on our readers or on the companies we work with.
What we do
When we can reproduce the problem, we tell you, and we tell you when we expect to fix it. We keep you updated until the fix is live. If you want credit, tell us the name to use and we add it to this page once the fix ships.
There is no paid bounty.
What is out of scope
We receive some reports often and take no action on them:
- Output from an automated scanner with no proof that the problem can be used.
- A missing header or cookie flag with no attack that depends on it.
- Email settings such as SPF, DKIM or DMARC, unless you can send a message that passes as ours.
- Problems in the services we use, such as Stripe or Cloudflare. Report those to the service.
The same address is in our security.txt, so security tools can find it.