Vulnerability Disclosure Policy#

Last updated: 2026-08-20

botBrains GmbH welcomes security research on GraceDNS. If you believe you have found a vulnerability, we want to hear from you.

Reporting#

• Email: security@gracedns.eu
• Machine-readable contact: /.well-known/security.txt
• Please include: a description of the issue, steps to reproduce, affected hosts or endpoints, and your assessment of impact. Proof-of-concept code is appreciated. English or German is fine.

We aim to acknowledge reports within 3 business days and to give you an initial assessment within 10 business days.

Scope#

In scope:

• gracedns.eu and all subdomains we operate, in particular dns.gracedns.eu, *.dns.gracedns.eu, control.gracedns.eu, block.gracedns.eu
• The GraceDNS resolver service (Do53, DoT, DoH endpoints)
• The GraceDNS control-plane API

Out of scope:

• Denial-of-service or volumetric testing against production resolvers
• Social engineering, phishing of our personnel, or physical attacks
• Third-party services we merely link to, and our upstream infrastructure providers (report Hetzner issues to Hetzner)
• Automated scanner reports without a demonstrated vulnerability
• SPF/DKIM/DMARC configuration reports without a demonstrated spoofing impact

Rules of engagement#

• Do not access, modify or delete data that is not your own; use your own test configurations wherever possible.
• Stop and report immediately if you encounter personal data of others.
• Do not degrade the service for other users.
• Do not publicly disclose the issue before the disclosure window below has passed or a fix is released, whichever comes first.

Safe harbor#

We will not initiate legal action or file criminal complaints against researchers who act in good faith, stay within this policy's scope and rules, and give us reasonable time to remediate. This includes research that would otherwise implicate the German Computer Crime provisions (§§ 202a ff. StGB), to the extent we can lawfully waive claims. If a third party initiates action against you for good-faith research under this policy, we will make it known that your actions were authorized by us.

Disclosure window#

We ask for a 90-day coordinated disclosure window from your report. If we ship a fix earlier, you are free to publish earlier; if remediation genuinely needs longer, we will explain why and agree on a new date with you. We credit researchers who wish to be named.

No bounty program (yet)#

We do not currently run a paid bug bounty program. We will say thank you, credit you if you like, and take your report seriously.

View as markdown