Last updated: 30th October 2026
HSK Ward Group is committed to keeping our systems and our customers' data secure. We welcome reports from security researchers and the public, and we will work with you to understand and fix any vulnerability you find. This policy explains what we cover, how to report an issue, and what you can expect from us.
Scope
This policy applies to the following systems and services:
Any system not listed above is out of scope. If you are unsure whether a system is covered, contact us at itsupport@hskwardgroup.com.au before testing. Vulnerabilities in third-party services we use should be reported to the vendor directly.
How to report a vulnerability
Send your report to itsupport@hskwardgroup.com.au. Please include:
- A description of the vulnerability and its potential impact
- The affected system, URL, or component
- Step-by-step instructions to reproduce it, including any proof-of-concept code
Reports may be submitted anonymously. We accept reports in EN.
Guidelines for researchers
When testing, we ask that you:
- Make a good-faith effort to avoid privacy violations, data destruction, and service disruption
- Access only the minimum data needed to demonstrate the issue, and stop testing once you have confirmed it
- Not view, modify, keep, or share data belonging to others; delete any such data you encounter
- Not use social engineering, phishing, or physical attacks against our staff or facilities
- Not perform denial-of-service or high-volume automated testing
- Give us reasonable time to fix the issue before disclosing it publicly
Out of scope
The following are not eligible under this policy:
- Findings from automated scanners without a demonstrated impact
- Missing security headers or cookie flags with no exploit path
- Clickjacking on pages with no sensitive actions
- Rate limiting or brute-force issues on non-authentication endpoints
- Vulnerabilities requiring a compromised device or outdated browser
Safe harbor
If you make a good-faith effort to comply with this policy, we will consider your research authorized. We will not pursue or support legal action against you, and if a third party takes legal action against you for activities conducted under this policy, we will make this authorization known. If you are unsure whether your testing complies with this policy, contact us before going further.
What to expect from us
When you submit a report, we will:
- Acknowledge receipt within 3 business days
- Confirm whether the issue is valid and share an initial assessment within 10 business days
- Keep you informed of our progress toward a fix
- Aim to resolve confirmed issues within 90 days, depending on severity and complexity
- Coordinate with you on the timing of any public disclosure
Rewards
- We do not currently offer monetary rewards for vulnerability reports, but we are grateful for your help and are happy to publicly acknowledge your contribution.
Questions
Questions about this policy can be sent to itsupport@hskwardgroup.com.au. We may update this policy from time to time; the date at the top shows the latest revision.