Responsible Disclosure Policy
1. Our Commitment
QTech Cyber Pty Ltd is committed to the security of our own systems and to supporting the broader Australian and global security research community. We recognise that independent security researchers play an important role in identifying vulnerabilities and improving cybersecurity outcomes. This Responsible Disclosure Policy sets out how we expect vulnerability disclosures to be made, how we will handle them, and the protections available to good-faith researchers.
This policy applies to vulnerabilities discovered in systems directly operated or maintained by QTech Cyber. It does not extend to client systems unless QTech Cyber has been contractually engaged to manage security on the client's behalf.
2. Legal Framework for Security Research in Australia
Security research conducted in accordance with this policy and in genuine good faith may be protected from prosecution under Australian law. However, researchers should be aware of the following legislation and ensure their activities remain lawful:
- Criminal Code Act 1995 (Cth) — Division 477: Prohibits unauthorised access to, modification of, or impairment of computer data and electronic communications. Authorisation under this policy is limited to passive discovery only — do not exploit, modify, delete, or exfiltrate data.
- Cybercrime Act 2001 (Cth): Creates offences relating to unauthorised access to or modification of restricted data. This policy does not constitute authorisation to access restricted data.
- Privacy Act 1988 (Cth): Personal information encountered during research must not be accessed beyond what is necessary to demonstrate the vulnerability, must not be retained, and must be reported to us confidentially.
- Telecommunications (Interception and Access) Act 1979 (Cth): Prohibits interception of communications without lawful authority.
Researchers operating outside the bounds of this policy, or who cause harm, disruption, or data loss, will not be afforded safe harbour protections and may be reported to relevant authorities.
3. Scope
This policy applies to the following in-scope assets:
- The QTech Cyber public website and its subdomains
- Publicly accessible QTech Cyber APIs and web services
- QTech Cyber corporate email infrastructure (configuration issues only, no testing of email content or accounts)
The following are explicitly out of scope and must not be tested under any circumstances:
- Client systems, networks, or applications — whether or not they are referenced on our website
- Third-party services or infrastructure used by QTech Cyber (report these to the relevant vendor directly)
- Any automated scanning or denial-of-service testing against any QTech Cyber asset
- Physical security testing of QTech Cyber premises or personnel
4. Reporting a Vulnerability
If you believe you have identified a security vulnerability within scope, please report it to us confidentially and promptly:
- Email: [email protected] (PGP key available on request for encrypted submissions)
- Acknowledgement SLA: We will acknowledge receipt of your report within 2 business days
- Triage SLA: We will complete initial triage and confirm scope within 5 business days
- Resolution SLA: We aim to remediate critical and high-severity findings within 30 days, and medium/low findings within 90 days
Please include in your report: a description of the vulnerability, the potential impact, steps to reproduce, any proof-of-concept (without exploiting or accessing real data), and your contact details for follow-up.
5. Good Faith Expectations
To qualify for safe harbour protections under this policy, researchers must:
- Act in genuine good faith to avoid harm to QTech Cyber, our clients, and the public
- Not access, copy, modify, delete, or exfiltrate personal information or confidential data
- Not disrupt, degrade, or deny access to QTech Cyber services or systems
- Not conduct social engineering, phishing, or physical security attacks against QTech Cyber personnel
- Not publicly disclose the vulnerability until QTech Cyber has had a reasonable opportunity to remediate it (typically 90 days from acknowledgement)
- Comply with all applicable Australian laws throughout the research process
6. Safe Harbour
Researchers who comply with this policy and act in genuine good faith will not face legal action from QTech Cyber in connection with their security research. We will not refer compliant researchers to law enforcement. This safe harbour does not extend to third-party legal claims, claims arising from intentional harm or data misuse, or activities that fall outside the scope of this policy.
7. Recognition
We appreciate the contribution of the security research community. Researchers who responsibly disclose valid, in-scope vulnerabilities will be acknowledged in our public Security Hall of Fame with their consent. We do not currently operate a paid bug bounty programme, however this position is under active review.