Coordinated disclosure
Vulnerability Disclosure
Permitted research
Test only devices, accounts and data you own or are authorised to use. Avoid service disruption, spam, social engineering, malware and public disclosure before users can be protected.
What a useful report contains
Provide the affected URL or version, reproduction steps, realistic impact and a suggested mitigation if known. Never attach real application content, identity documents, executable files or secrets.
Contact status
Qap Criteria publishes a standards-based /.well-known/security.txt that prepares reports to support@qapcriteria.com.au with the subject prefix [Security]. The policy is technically prepared, but public reporting must not be treated as operational until mailbox delivery, spam filtering and monitoring are verified for the free iOS market-validation release.
Response targets
Once the support mailbox is verified, reports will be reviewed during normal Australian business operations and answered as reasonably practicable, with updates for confirmed high-severity issues.