Keeping our systems safe is very important. We work hard to protect our information and communication technology (ICT) systems, apps, and services, but sometimes problems can still happen.
We welcome help from the security community. That’s why we have a Vulnerability Disclosure Program (VDP). It gives people a safe and responsible way to tell us about security issues.
If you find a possible problem in our systems, services, or products, please tell us quickly. Follow the steps on how to disclose a vulnerability.
This program helps us find, check, and fix security problems in a clear and responsible way. We invite researchers, staff, contractors, and partners to report issues in good faith.
Note: This program is only for reporting security problems. We won’t reply to general questions about our services.
What’s covered
You can report issues in:
- ICT systems, apps, services, and environments we own or run
- ICT products and services we provide to shared service partners
- systems and services you are legally allowed to access.
What’s not allowed
To keep this program safe and fair, do not:
- use social engineering or phishing
- launch DoS or DDoS attacks
- try to damage or break into our buildings or equipment
- try to change, delete, or steal data
- use tricks like clickjacking
- access accounts or data that aren’t yours
- send or spread malware
- send automated scan reports
- test third-party systems that connect to ours
- use any method that could harm our systems or data.
Also, don’t report issues that are not real risks, like:
- weak or misconfigured SSL/TLS certificates
- DNS settings like SPF or DMARC
- missing HTTP headers (e.g., permissions policy)
- theoretical CSRF or cross-site framing issues
How to report a vulnerability
If you find a possible issue, email us at: VulnerabilityDisclosure@dcceew.gov.au.
Include as much detail as you can:
- what the issue is
- what system, service, or product is affected (if known)
- steps to show or repeat the issue
- any test accounts you used (if any)
- your contact info (optional)
- if you want public credit, tell us the name to use.
What happens next
If you report in good faith, we won’t take legal or disciplinary action. You can ask for public credit.
Here’s what we’ll do:
- reply to valid reports within 2 business days
- review and log the issue for fixing
- send updates if needed.
We won’t:
- pay money for reports
- share your details without your permission.