# Vulnerability Disclosure Policy

**Effective date:** 19 August 2026

## Security testing is not authorised

TERESEC does not authorise security testing of its website, services or infrastructure. Scanning, probing, fuzzing, credential testing, exploitation attempts or any other form of security testing against our systems without our prior written authorisation is prohibited.

Unauthorised access to, or interference with, computer systems may constitute an offence under the *Criminal Code Act 1995* (Cth) and other Australian law. We monitor our systems, we investigate suspicious activity, and we reserve the right to refer unauthorised activity to the relevant authorities.

This policy is not an invitation to test. It exists so that a person who believes they have found a vulnerability — in the course of ordinary use of our website — knows how to tell us responsibly.

## If you believe you have found a vulnerability

Report it to **[security@teresec.com.au](mailto:security@teresec.com.au)** with:

- A clear description of what you observed
- The URL or service involved and steps to reproduce
- Any supporting evidence you already have

Do not attempt to confirm, expand or demonstrate the issue beyond what you have already observed. Do not access, copy or modify data that is not yours. Do not disclose the issue publicly before we have had a reasonable opportunity to address it.

We aim to acknowledge reports within 5 business days.

## Good-faith reports

We will not pursue or recommend legal action over a report made in good faith, provided you:

- Discovered the issue through ordinary use, not deliberate testing
- Did not exploit it beyond the minimum incidental observation
- Did not access, alter or delete anyone else's data
- Did not disrupt our services
- Did not demand payment or other benefit in exchange for the report or for withholding disclosure
- Gave us a reasonable opportunity to remediate before any public disclosure

We do not operate a bug bounty and do not pay for reports.

## Out of scope

Issues in our third-party providers' own infrastructure — including Microsoft Azure and Cloudflare — should be reported directly to the provider concerned.

## Contact

**TERESEC Pty Ltd**
[security@teresec.com.au](mailto:security@teresec.com.au)

Machine-readable details: [/.well-known/security.txt](/.well-known/security.txt)