Australian Competition and Consumer Commission
Vulnerability disclosure program on security.txt accc.gov.au
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
As an Australian Government agency, we can’t compensate individuals or organisations for finding potential or confirmed security vulnerabilities.
- Safe harbor
-
Full
To encourage responsible reporting, we will not take legal action against security researchers in relation to the discovery and reporting of a potential security vulnerability.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 9 excluded.
Domains 3
- accc.gov.au
- productsafety.gov.au
- scamwatch.gov.au
Products and areas 1
- Products or services wholly owned by the agency to which you have lawful access
Out of scope (9)
- Any other action that is unlawful or contrary to legally enforceable terms and conditions for using a product or service.
- Attempts to extract or exfiltrate sensitive data
- Attempts to modify or destroy data
- Clickjacking
- Denial of service (DoS or DDoS) attacks
- Physical attacks
- Posting, transmitting, uploading, linking to, or sending any malware
- Social engineering or phishing
- Weak or insecure SSL ciphers and certificates
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Australian Competition and Consumer Commission's policy. "We" in these lines means the program, not this site.
While testing
-
We allow responsible security research on our products and services to which you have authorised access.
-
Any responsible security research on our products and services must be undertaken under Australian law, and not compromise or exploit the ACCC’s data, employees, infrastructure, operations, and activities.
-
We ask that you maintain confidentiality until we have remediated or mitigated the potential security vulnerability.
-
Public disclosure of any potential security vulnerability is not permitted without our express written consent.
Not accepted
-
Clickjacking
-
Social engineering or phishing
-
Weak or insecure SSL ciphers and certificates
-
Denial of service (DoS or DDoS) attacks
-
Posting, transmitting, uploading, linking to, or sending any malware
-
Physical attacks
-
Attempts to modify or destroy data
-
Attempts to extract or exfiltrate sensitive data
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
-
Scope +
Added to scope: productsafety.gov.au
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.