Vulnerability disclosure policy
Last updated: 23 October 2026
Keeping websites safe is what we do, so we take the security of our own just as seriously. If you think you’ve found a security problem with this website or any of our systems, we’d like to hear from you, and we’ll work with you to fix it.
How to report a vulnerability
Email [email protected]. Please include:
- the address (URL) or system affected
- what the problem is and what someone could do with it
- the steps to reproduce it, with screenshots or a short proof of concept if you have one
- a Cloudflare Ray ID or the date and time you tested, so we can find it in our logs
- how to contact you, and whether you’d like to be thanked by name
If you need to send us something sensitive, say so in your first email and we’ll arrange a secure way to share it. You can report anonymously, but then we can’t update you or ask questions.
What you can expect from us
- We’ll confirm we’ve received your report within 3 business days.
- We’ll tell you what we think of it, and what we plan to do, within 10 business days.
- We’ll keep you updated while we fix it, and tell you when it’s fixed.
- With your permission, we’ll thank you by name on this page once the issue is fixed.
No bug bounty
We’re a small business and don’t run a bug bounty or pay for reports. Please don’t ask for payment as a condition of telling us about a problem. We’re very grateful for good-faith reports, and we’re happy to thank you publicly.
What’s in scope
- This website,
webcontrol.com.au, and its subdomains that we run. - Our contact and support forms, and how we handle what’s sent through them.
- Our email domain’s configuration (for example SPF, DKIM and DMARC) where it creates a real risk, such as letting someone send convincing email as us.
What’s out of scope
- Our clients’ websites and systems. They belong to our clients, and we can’t authorise anyone to test them. If you find a problem with one, report it to that organisation directly.
- Services we use but don’t run, such as Cloudflare, our email provider and WordPress itself. Please report those to the vendor (Cloudflare has its own disclosure program).
- Denial-of-service testing, load testing, or anything that degrades the site for others.
- Social engineering, phishing or physical testing of us, our clients or our suppliers.
- Automated scanner output with no demonstrated impact, and best-practice suggestions with no practical risk (for example a missing header on a page with nothing to protect). You’re welcome to tell us, but they may not get a detailed reply.
Please test responsibly
- Only do what you need to show the problem exists. Stop once you’ve shown it.
- Don’t view, change, delete or keep data that isn’t yours. If you come across personal information, stop, don’t share it, and tell us in your report.
- Don’t send large volumes of requests or form submissions. Our firewall will block you anyway, and it makes your report harder for us to find.
- Don’t use what you find to access anything further, keep access, or move to other systems.
- Give us a reasonable time to fix the problem before you tell anyone else about it. We ask for up to 90 days, and we’ll agree a disclosure date with you.
Safe harbour
If you make a good-faith effort to follow this policy, we will treat your research as authorised: we won’t take legal action against you or ask law enforcement to investigate you for it. If someone else takes legal action against you over research that followed this policy, we’ll make it known that your work was authorised by us. This doesn’t cover systems we don’t own (see “What’s out of scope”), and it doesn’t override the law.
If you’re unsure whether something is covered, email us before you test.
Thank you
No reports yet. Researchers who help us fix a problem will be listed here, with their permission.