Extranet Systems Pty Ltd (ABN 29 632 743 189) ("Extranet Systems", "we", "us") values the work of security researchers. This policy explains how to report a vulnerability to us, what we ask of you, and what you can expect from us in return. It applies to vulnerabilities in systems that we own and operate, including our websites and the PentestOps platform, and it is the policy referred to in the security.txt file published on our domains.
What is in scope
- Websites and services at extranetsystems.com.au and its subdomains.
- The PentestOps platform at pentestops.com and its subdomains, including the PentestOps agent and its application programming interfaces.
- Other internet-facing systems that we own and operate, where we have confirmed that to you in writing.
What is out of scope
- Our clients' systems. Systems we build, host or manage for a client belong to that client. We are not able to authorise testing of them, and testing them without the client's written authorisation may be a criminal offence. If you believe you have found a vulnerability in a client system, please report it to us and we will coordinate with the client.
- Third-party services we use but do not operate, such as email, collaboration, hosting and payment providers. Please report these to the provider under its own disclosure policy.
- Social engineering of our people, clients or suppliers, including phishing, pretexting and physical intrusion.
- Denial of service, resource exhaustion, brute force against authentication, and automated scanning at a volume that degrades service.
- Findings with no demonstrable security impact, such as missing best-practice headers alone, version disclosure alone, clickjacking on pages with no sensitive action, and reports generated by automated tools without validation.
Rules for good-faith research
To be covered by this policy, you must:
- Test only systems that are in scope, and stop testing a system immediately if you find that it belongs to a client or a third party.
- Access, copy or retain only the minimum data needed to demonstrate the vulnerability. Do not access, modify, delete or exfiltrate data that is not your own. If you encounter personal information or confidential information, stop, record only that you reached it, and report it to us.
- Not degrade, disrupt or damage any system or service, and not install anything that persists on our systems.
- Not use a vulnerability to pivot to other systems or to escalate privileges beyond what is needed to prove the finding.
- Not demand payment, and not threaten or attempt to extort us or anyone else.
- Keep the vulnerability confidential until we have resolved it and agreed on disclosure, as set out below.
- Comply with all laws that apply to you, including the Criminal Code Act 1995 (Cth) and the Crimes Act 1900 (NSW) in Australia, and the equivalent laws where you are.
How to report
Email info@extranetsystems.com.au with the subject "Vulnerability report". Please include:
- The affected system, address or component.
- The type of vulnerability and its potential impact.
- Step-by-step instructions to reproduce it, with any proof-of-concept code, requests or screenshots.
- How we can contact you. You may report anonymously, but we cannot then keep you informed or credit you.
Please do not include working exploits for third-party software, and do not send large data extracts. If you need to send sensitive material, tell us and we will arrange an encrypted channel.
What you can expect from us
- Acknowledgement within three business days of receiving your report.
- Assessment within ten business days, including our view of severity and whether the finding is in scope. We may ask for more information.
- Remediation as quickly as the severity warrants. Our target is to resolve critical and high severity vulnerabilities within 30 days and others within 90 days. We will keep you informed of progress.
- Coordinated disclosure. We ask you not to disclose the vulnerability publicly until we have resolved it, or until 90 days have passed since your report, whichever is earlier, unless we agree a different period with you in writing because the fix genuinely needs longer. We will not ask you to keep a resolved vulnerability secret.
- Recognition. We do not operate a bug bounty and do not pay for reports. With your consent we will thank you by name or handle on our website for a valid report of an in-scope vulnerability that we were not already aware of.
Safe harbour
If you conduct security research and reporting in good faith and in accordance with this policy, Extranet Systems will consider your research to be authorised, will not initiate legal action against you for it, and will not refer it to law enforcement, provided you did not act in a way that this policy prohibits. If a third party, including a client, raises legal action against you for research conducted in accordance with this policy, we will make it known that your actions were conducted under this policy. This policy cannot authorise research against systems that we do not own, and it does not bind third parties.
If you are unsure whether a particular test is within this policy, ask us first at info@extranetsystems.com.au before you proceed.
Our clients' obligations under PentestOps
PentestOps customers test their own systems under the Acceptable Use Policy, which requires written authorisation for every target. Nothing in this disclosure policy changes those obligations.
Review
This policy is reviewed at least annually. The current version is always the one published at extranetsystems.com.au/policies/responsible-disclosure/.
Contact
See all our policies