Skip to content
← Trust CentreTRUST

Responsible Disclosure

How security researchers can report suspected vulnerabilities.

Version 1.0Effective 1 August 2026Last updated 22 July 2026

Reporting a security concern

Please report suspected vulnerabilities privately through the legal or security contact shown on this site. Include affected URL or component, steps to reproduce, potential impact and safe supporting evidence.

Research expectations

Do not access unnecessary data, disrupt service, use social engineering, alter records, demand payment, disclose publicly before we have had a reasonable opportunity to investigate, or test customer organisations without permission.

Our response

We will acknowledge credible reports, investigate and keep the reporter informed where practicable. This policy is not a promise of reward or immunity and does not authorise unlawful activity.