ISC's Security Vulnerability Disclosure Policy is documented in the relevant ISC Knowledgebase article.

Please see BIND 9 threat model first.

If you think you may be seeing a potential security vulnerability in BIND (for example, a crash with a REQUIRE, INSIST, or ASSERT failure), please report it immediately by opening a confidential GitLab issue.

Please do not discuss undisclosed security vulnerabilities on any public mailing list. ISC has a long history of handling reported vulnerabilities promptly and effectively and we respect and acknowledge responsible reporters.

If you have a crash, you may want to consult the Knowledgebase article entitled "What to do if your BIND or DHCP server has crashed".

We are working with the interests of the greater Internet at heart, and we hope you are too. In that vein, we do not offer bug bounties. If you think you have found a bug in any ISC software, we encourage you to report it responsibly; if verified, we will be happy to credit you in our Release Notes.