Report a vulnerability

We protect other organisations for a living, so we take reports about our own security seriously. If you believe you have found a vulnerability in this website or its API, please tell us. This policy is also published in /.well-known/security.txt.

How to report

Email security@solsentra.au with a description of the issue, the steps to reproduce it, the affected address and any proof-of-concept. Please give us a way to contact you.

In scope

• This website and its subdomains that we operate.
• The website’s form API under /api/.

Out of scope

• Denial of service, load testing or automated scanning at volume.
• Social engineering of our staff, and physical attacks on our offices.
• Third-party services we use but do not operate.
• Reports from automated tools without a demonstrated, exploitable issue, such as missing headers on non-sensitive files.

Safe harbour

If you act in good faith and follow this policy, we will not pursue legal action against you for your research. Good faith means: you avoid harm to our users and services, you access only the minimum data needed to demonstrate the issue and do not keep it, you do not change or delete data, and you give us reasonable time to fix the issue before telling anyone else.

What happens next

• We acknowledge your report within 3 business days.
• We triage it and tell you our assessment within 10 business days.
• We keep you informed while we fix it, and agree a disclosure date with you.

We do not run a paid bug bounty. With your permission, we are glad to thank you publicly once the issue is fixed.