Security & Vulnerability Disclosure Policy

Last revised: 2026-07-04

Namefi tokenizes real ICANN domains as NFTs and manages their DNS. Protecting the domains, DNS control, and accounts that our users trust us with is core to what we do. We welcome and value the work of security researchers, and we are committed to working with the community to verify, reproduce, and respond to legitimate reports.

This policy covers the Namefi web application and APIs (namefi.io and its services). It is a recognition-only Vulnerability Disclosure Program (VDP): we do not offer monetary rewards for web-app reports — the incentive is public credit and our thanks (see the Whitehat Hall of Fame). Paid rewards exist only for smart-contract findings, which are handled by a separate program — see Rewards below.

How to report

Email your report to security@namefi.io. For sensitive details, encrypt with our OpenPGP key at https://namefi.io/pgp-key.txt — plaintext is fine for first contact, and we'll establish an encrypted channel before you send anything sensitive.

Machine-readable metadata for this policy lives at /.well-known/security.txt (RFC 9116).

What to include

A good report lets us reproduce the issue quickly:

• A clear description of the vulnerability and its security impact.
• Step-by-step reproduction instructions, and the affected URL(s) / endpoint(s).
• A proof of concept (request/response, script, screenshots, or short video).
• Any accounts, roles, or preconditions needed to reproduce.

Please report one issue per submission, and give us reasonable time to respond before any public disclosure (see Coordinated disclosure).

Our commitment

When you report in good faith under this policy, we will:

• Acknowledge receipt of your report as promptly as we can.
• Work with you to understand and validate the issue, keeping you informed of our progress toward a fix.
• Treat you with respect, and credit you in the Whitehat Hall of Fame once the issue is resolved, if you'd like the recognition.

Response and remediation timelines depend on severity and complexity; the targets above are goals, not contractual SLAs.

Scope

In scope

• The Namefi web application at namefi.io and its subdomains.
• Namefi's public web APIs.

Vulnerability classes we especially want to hear about:

• Authentication, session management, and account-takeover flaws.
• Broken access control / IDOR that exposes or lets you act on another user's domains, DNS records, orders, or personal data.
• Injection with real impact (SQLi, stored/reflected XSS, SSRF, RCE).
• Business-logic flaws affecting domain ownership, DNS control, or payments.
• Sensitive-data exposure.

Smart-contract vulnerabilities are out of scope for this VDP. Namefi's on-chain contracts are covered by a separate, paid bug-bounty program with its own scope and rules. See Rewards.

Out of scope

The following are generally not eligible under this policy. Reports limited to these will typically be closed as informational unless you can demonstrate a concrete, exploitable security impact:

• Denial of service (DoS/DDoS), volumetric, brute-force, or automated rate-based testing.
• Physical attacks, or attacks requiring physical access to a device.
• Social engineering or phishing of Namefi staff, users, contractors, or vendors.
• Unconfirmed output from automated tools/scanners without a working proof of concept.
• SPF / DKIM / DMARC configuration suggestions.
• Missing security headers without a demonstrated exploit.
• Login / logout / other low-impact CSRF.
• Theoretical subdomain takeover without supporting evidence (e.g. a live, claimable resource).
• Missing cookie flags on non-sensitive cookies.
• Rate-limiting concerns without a concrete, demonstrated impact.
• Self-XSS, clickjacking on pages with no sensitive actions, content/text spoofing without an attack vector.
• Best-practice or informational findings with no security impact.
• Vulnerabilities in third-party services or dependencies not under Namefi's control — please report those to the upstream vendor.

Safe harbor

We consider good-faith security research conducted under this policy to be authorized conduct. When you make a good-faith effort to comply with this policy during your research:

• We will not pursue or support legal action against you for accidental, good-faith violations of this policy, including under the Computer Fraud and Abuse Act or similar laws.
• We consider your research authorized, and we waive any relevant restrictions in our Terms of Service and Acceptable Use Policy that would otherwise prohibit it — for the limited purpose of your good-faith research under this policy.
• If a third party initiates legal action against you for activities conducted in accordance with this policy, we will make it known that your actions were authorized under this policy.

To stay in scope of safe harbor: act in good faith, only interact with accounts you own or have explicit permission to test, avoid privacy violations and service degradation, do not access or modify other users' data beyond the minimum needed to demonstrate the issue, delete any such data once you've reported it, and do not publicly disclose before we've had a chance to remediate (see below). This safe-harbor language follows the disclose.io core terms.

Coordinated disclosure

We ask for coordinated disclosure:

• Give us reasonable time to investigate and remediate before disclosing to others.
• After we ship a fix, you're welcome to publish a high-level write-up of the issue.
• Please withhold detailed exploit code / a fully-weaponized PoC for 60 days after the fix is deployed (the "post-fix PoC embargo"), so users have time to update.
• If you believe an issue poses an active, ongoing risk to users, tell us — we will prioritize accordingly.

Rewards — recognition only

This is a recognition-only program for the web application: valid, in-scope reports earn public credit in the Whitehat Hall of Fame and our sincere thanks — not monetary rewards.

Monetary rewards are reserved for smart-contract vulnerabilities, which are handled by a separate, self-run bug-bounty program (impact-based severity, rewards paid from the treasury, testnet-only PoC). If your finding is in Namefi's on-chain contracts, please follow that program instead of this VDP.

Whitehat Hall of Fame

With gratitude to the researchers who have responsibly disclosed valid, in-scope vulnerabilities and helped keep Namefi users safe. If you'd like to be listed here after your report is resolved, just let us know.

Changes to this policy

We may update this policy as our program matures. The "Last revised" date at the top reflects the most recent change. Material updates will be reflected here and in /.well-known/security.txt.