At Compliance Quarter, the security of our systems and the data entrusted to us is of utmost importance. We are committed to maintaining a safe and secure environment for our clients and visitors. This policy outlines the steps for reporting vulnerabilities and our commitment to addressing them promptly.
1. Introduction
We appreciate the efforts of the security community in identifying and responsibly disclosing vulnerabilities. If you believe you’ve found a security vulnerability in our systems, we encourage you to report it to us as outlined below.
2. Reporting a Vulnerability
• Email: Please send your vulnerability reports to info@compliancequarter.com.au.
• Report Contents:
• A detailed description of the vulnerability.
• Steps to reproduce the issue.
• Any relevant screenshots or proof-of-concept code.
• Your contact information (name, email, and preferred method of communication).
3. Scope
The following domains and services are within the scope of this policy:
• In Scope:
• www.compliancequarter.com.au
• Any other subdomains owned and operated by Compliance Quarter.
• Out of Scope:
• Third-party services and applications.
• Denial of Service (DoS) attacks.
• Physical security issues.
4. Guidelines for Researchers
To ensure the security of our systems and data, please adhere to the following guidelines:
• Do:
• Perform testing only on systems within the scope of this policy.
• Use only exploits necessary to demonstrate a vulnerability.
• Keep information about any vulnerabilities you discover confidential between us.
• Do Not:
• Access or modify data without authorization.
• Disrupt or degrade our services.
• Use social engineering, phishing, or physical attacks.
• Violate any applicable laws or regulations.
5. Legal Safe Harbor
We will not initiate legal action against researchers who:
• Follow the guidelines set forth in this policy.
• Engage in testing within the scope.
• Report vulnerabilities promptly.
• Avoid privacy violations, disclosure of sensitive information, destruction of data, and interruption of services.
6. Our Commitment
When you report a vulnerability:
• Acknowledgment: We will acknowledge receipt of your report within 3 business days.
• Investigation: We will investigate the issue and provide an estimated timeline for resolution.
• Communication: We will keep you informed of our progress.
• Confidentiality: We will not share your personal information without your consent.
• Recognition: With your permission, we may acknowledge your contribution once the vulnerability is resolved.
7. Recognition and Rewards
We are a small business and do not have a significant bounty program. However, we may (and have always previously) offer a token of appreciation for any medium to significant vulnerability reports that help improve our security.
8. Privacy
Any personal information you provide will be used solely for the purpose of contacting you regarding your report. We will handle your data in accordance with our Privacy Policy.
9. Changes to This Policy
We may update this Vulnerability Disclosure Policy from time to time. The latest version will always be available on our website.
10. Contact Us
If you have any questions about this policy, please contact us at info@compliancequarter.com.au.
Thank you for helping us keep Compliance Quarter safe and secure.