Security

Reporting a vulnerability

If you find a security problem in HostDC, email abuse@hostdc.xyz. Please include what you found, the steps to reproduce it, and what an attacker could do with it. You can write in English or German.

We confirm receipt within 3 working days, keep you updated while we work on a fix, and tell you when it is fixed.

Please

• Test only against your own account and your own bots.
• Do not read, change or delete other people's data. If you reach any by accident, stop there and tell us.
• Do not run denial of service tests, spam, or social engineering against our staff or users.
• Give us reasonable time to fix the problem before you publish anything.

If you act in good faith and within these rules, we will not take legal action against you for your research.

Not a vulnerability

Abuse by a hosted bot (spam, raids, illegal content) is not a security bug in HostDC. Report it on the report page instead.

Our machine readable contact file is at /.well-known/security.txt.