Trust & Security Policy
RFC 9116 coordinated vulnerability disclosure guidelines, researcher safe harbor terms, and our formal Zero-Retention DNS query pledge.
Zero-Retention DNS Query Guarantee
SubdomainWatch operates under strict non-retention privacy standards. We treat all domain reconnaissance queries and customer infrastructure telemetry with zero data monetization.
Ephemeral Probing
Public diagnostic queries (/api/probe) evaluate DNS records in volatile memory only. No resolution history or IP addresses are persisted.
Tenant Isolation
Console monitors and zone files are strictly isolated using PostgreSQL Row-Level Security (RLS) cryptographically bound to authenticated session claims.
Zero Third-Party Feeds
Queried customer domains are never shared with advertising networks, passive DNS data brokers, or speculative external aggregators.
Coordinated Disclosure Channel
SubdomainWatch values the global security research community. We welcome responsible reports of potential security vulnerabilities across our platform. Please submit all findings directly to:
Include reproduction steps, estimated impact, and sample payloads. Please do not publish findings until coordinated remediation is verified.
Scope of Assessment
subdomainwatch.com*.subdomainwatch.comweb apps- Public scanner API endpoints (
/api/probe,/api/tools/*) - Console authentication & tenant isolation logic
- Email authentication and SPF/DMARC validation engine
- Volumetric Denial of Service (DoS/DDoS) attacks
- Social engineering, spearphishing, or physical attacks
- Third-party cloud infrastructure (Fly.io, Supabase, Resend)
- Targeting or scanning monitored customer domains
- Destructive data modification or service disruption
Researcher Safe Harbor Commitment
If you conduct vulnerability research and report findings in good-faith compliance with this policy, we will consider your activities authorized, will not initiate legal action against you, and will work constructively with you to validate and remediate the issue promptly.