DOMINION FORTRESS / Security Testing Policy

Security Testing Policy

Effective date: 11 October 2026

Dominion Fortress provides cybersecurity assessments and authorized testing. This policy describes the minimum rules for any security work we conduct and for reports sent to our team. It is not a blanket authorization to test any system, and it does not create a public bug bounty program.

Authorization is required

• Testing begins only after the system owner or an authorized representative has provided written permission.
• Every engagement must define the approved domains, IP ranges, applications, accounts, test window, methods, rate limits, exclusions and escalation contact.
• Permission for one asset does not imply permission for connected third-party services, hosting providers, customer systems or other assets.
• Publicly available tools on this website perform only the checks described on their pages. They do not authorize intrusive testing or exploitation.

Prohibited actions

• Testing systems without permission, or exceeding the agreed scope.
• Accessing, changing, deleting, exporting or retaining data that is not necessary to demonstrate an approved finding.
• Denial-of-service testing, destructive testing, persistence, malware deployment, credential theft, phishing or social engineering unless separately and explicitly authorized in writing.
• Attempting to bypass safeguards on third-party platforms or contacting their staff as part of a test without written authorization and a documented plan.
• Publishing findings or identifying customer systems without the owner's permission.

Handling a suspected vulnerability

If you believe you have found a vulnerability in a system operated by Dominion Fortress, send a concise report to www.bilalanwar01@gmail.com. Include the affected URL or component, impact, reproducible steps, relevant timestamps and a safe proof of concept. Remove secrets and personal data from the report wherever possible.

Please do not exploit a suspected issue beyond the minimum steps necessary to confirm it, access another person's data, disrupt service, or publish details before we have had a reasonable opportunity to review it. We will assess reports in good faith, but we do not promise a response time, reward, safe-harbor protection for unauthorized activity or a bounty unless a separate written agreement says so.

Client engagement controls

For paid testing, the signed scope and authorization documents govern the engagement. We document material findings, communicate urgent risks through the agreed channel and limit evidence collection to what is needed for verification and reporting.

Contact

For authorization, scope questions or responsible reports, email www.bilalanwar01@gmail.com.