Reporting a security problem

We set up security for other companies, so we take reports about our own site seriously. If you find a vulnerability in www.tenantzero.eu, please tell us before anyone else.

How to report

Email security@tenantzero.eu. Please include:

• what you found and where (URL, page or request)
• steps to reproduce it, or a short proof of concept
• what an attacker could do with it, as you see it

Reports in English or German are welcome.

What happens next

• We reply within 5 working days.
• We keep you updated until the problem is fixed.
• If you’d like, we credit you once it’s fixed.
• Please give us reasonable time to fix it before you publish anything about it.

Scope

In scope: this website, the free domain and website check, the setup questionnaire and the MTA-STS policy host (mta-sts.tenantzero.eu).

Out of scope: denial-of-service by traffic volume, social engineering, physical attacks, and reports that only list scanner output without showing an impact. The domain check reads public information about any domain by design; that on its own is not a vulnerability.

Good faith

We will not take legal action against anyone who reports in good faith, stays within this scope, avoids harming visitors or their data, and doesn’t access more data than needed to show the problem.

Machine-readable contact details: /.well-known/security.txt (RFC 9116).