Public document
Security and vulnerability disclosure
How to report a suspected security vulnerability in OSKA, and what happens after you do.
This policy is an operational draft. The owner must confirm the reporting contact and any response commitments before it is approved; until then it makes no promise of a response time or of legal safe harbour.
1. Reporting a vulnerability
Email [email protected] with "Security report" in the subject. Describe the affected address or feature, the steps that reproduce the issue, the impact you observed and how we can reach you.
Please report privately and give us a reasonable opportunity to fix the issue before you disclose it to anyone else.
2. Scope
This policy covers the OSKA staff workspace at control.aussiewebsites.au, the client portal at portal.aussiewebsites.au, and the services behind them. Third-party services we use, such as payment and email providers, are outside it: report an issue in one of them to that provider.
3. Testing in good faith
While investigating, please:
- use only accounts you own or have permission to use;
- never access, change, download or delete data that is not yours, and stop as soon as you reach someone else's information;
- avoid anything that degrades the service for others, including denial-of-service, automated high-volume scanning, spam and social engineering of our staff or clients.
4. After you report
Reports reach the Aussie Websites team, who investigate them. Response timeframes and how outcomes are shared with reporters have not yet been approved, so this draft does not commit to either.
5. Machine-readable contact
The same contact is published at /.well-known/security.txt on both hosts, in the RFC 9116 format security tools read.