Responsible Disclosure Policy

Principles

At Swift Digital, we prioritise security and appreciate the efforts of security researchers in safeguarding the safety and privacy of our users. If you believe you’ve discovered a security vulnerability in our systems, we kindly ask that you report it to us responsibly.

Reporting a vulnerability

If you identify a vulnerability, please email us at security@swiftdigital.com.au with the following details:

• A description of the vulnerability

• Steps to reproduce the issue

• Potential impact

• Any supporting materials (e.g., screenshots, proof of concept)

We kindly request that you:

• Refrain from exploiting the vulnerability or accessing data that doesn’t belong to you.

• Avoid publicly disclosing the issue before we’ve had the opportunity to address it.

• Allow us a reasonable amount of time to fix the issue before any public disclosure.

Any personal information you submit will be handled in line with Swift Digital’s Privacy Policy, which can be found at: www.swiftdigital.com.au/platform-privacy-and-spam-policy/. Alternatively, you can choose to remain anonymous or use a pseudonym.

What You Can Expect

• We will acknowledge your report within 5 business days.

• We’ll keep you updated as we work on resolving the issue.

• Our goal is to address critical issues within 30 days and non-critical issues as needed.

• With your consent, we may publicly credit you for your discovery.

Out of Scope

• Physical security testing (e.g., office break-ins)

• Social engineering (e.g., phishing)

• Automated scanning without prior approval

• Attacks that result in denial of service

Safe Harbor

As long as you adhere to this policy when reporting a vulnerability, we will not take legal action against you. We view responsible disclosure as being in good faith, even if it leads to unintentional privacy issues or service disruptions.

People who have disclosed vulnerabilities

The following individuals or aliases have identified and disclosed vulnerabilities to us: