Version 1.0 · 10 November 2026
Vulnerability disclosure policy
If you find a security weakness in DOME Guard or our systems, please tell us privately first. We will work with you, fix it and credit you if you want.
How to report
- Email info@ionity.today with "SECURITY" in the subject.
- Say what you found, where, how to reproduce it and the impact you expect.
- Do not send other people's data.
In scope
- DOME Guard for Windows (host, engine, interface)
- DOME VPN gateway installer and agent
- dome.ionity.co.za, ionity-dome-guard.web.app and the DOME Guard Firebase project
Out of scope
- Denial of service, spam or load testing
- Social engineering or physical attacks
- Weaknesses in Windows, Microsoft Defender, WireGuard, OpenVPN or Google services themselves — please report those to the vendor
Our promise
| We will | Within |
|---|---|
| Confirm we received your report | 3 business days |
| Confirm the issue and its severity | 10 business days |
| Fix or mitigate | 90 days (sooner if critical) |
| Credit you in the release notes, if you wish | At release |
Safe harbour
If you act in good faith, follow this policy, avoid harm to users or data, and give us reasonable time to fix the issue before disclosing it, we will not take legal action against you for your research.