Vulnerability Disclosure Policy
About this policy
Keystart is committed to ensuring the security of its customers and employees by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preference in how to submit any discovered vulnerabilities.
This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and what you can expect from us.
If you make a good faith effort to comply with this policy during your security research, we will not take any legal action against you.
We will not compensate you for finding potential or confirmed vulnerabilities.
What this policy covers
In scope: This policy applies to the following systems and services:
- The main keystart.com.au website.
- Out of scope: websites and APIs hosted on other subdomains or with (Cloud) providers are not in scope and not authorised for testing.
- Keystart mobile app(s), available at Apple App Store and Google Play Store.
Out of scope
Systems not listed above, including any third-party services or integrations, are excluded from scope, and not authorised for testing. If you aren’t sure whether a system is in scope, please contact Keystart at infosec@keystart.com.au to discuss.
The following activities are out of scope and not permitted against any system:
- denial of service (DoS/DDoS) and spam.
- social engineering (e.g. phishing) against staff.
- physical access attacks (e.g. attempting to access buildings).
- uploading malware, backdoors, webshells, or other “weaponised” exploits that could degrade system security or affect other users.
- attempts to access or manipulate accounts that do not belong to you (e.g. resetting passwords for other users).
- any attempts to modify or destroy data.
In general, low severity issues without a direct security impact (weak SSL cipher suites, missing HTTP security headers, SPF/DKIM/DMARC misconfigurations, etc.) will not be considered in scope.
How to report a vulnerability
To report a vulnerability, please submit all reports to infosec@keystart.com.au.
To expedite the triaging and prioritisation of submission, your reports should:
- describe where the vulnerability was discovered and the potential impact of exploitation;
- include enough detail so we can reproduce your steps. Screenshots and proof of concept code are helpful; and
- include your contact details.
What happens next
We will coordinate with you as openly and as quickly as possible during the remediation of any identified vulnerabilities.
We will:
- respond to your report within 10 business days.
- keep you informed throughout our internal investigation and remediation (if required) of the identified vulnerability.
- credit you, in name, as the person who discovered the vulnerability, unless you prefer to remain anonymous.
People who have disclosed vulnerabilities to us
Below are the names or aliases of people who have identified and disclosed vulnerabilities to us:
- no records yet