New Zealand Intelligence Community (NZIC)
Vulnerability disclosure program on Self-hosted ncsc.govt.nz
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 7
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The old policy link stopped working, so we followed the company's security.txt to the current policy.
This program does not pay cash rewards.
- Response
-
Within 7 days
We will acknowledge receipt of your report within seven days and provide an outline response plan where applicable.
- Safe harbor
-
Full
We will not take legal action against you, suspend or terminate your access to our services as long as you follow these guidelines when reporting the issue to us.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
7 assets you may test, 2 excluded.
Domains 7
- beyondordinary.nzic.govt.nz
- gcsb.govt.nz
- ncsc.govt.nz
- nzic.govt.nz
- nzism.gcsb.govt.nz
- nzsis.govt.nz
- protectivesecurity.govt.nz
Out of scope (2)
- Any other government departments or agency providers and services
- Services hosted by third-party providers or vendors
Rules
What the policy asks of you, and the bug types it won't reward, quoted from New Zealand Intelligence Community (NZIC)'s policy. "We" in these lines means the program, not this site.
While testing
-
make every effort to avoid: a breach of the privacy of individuals, anything that will slow the system down for users, disruption to production systems, or destruction of data
-
perform research only within the scope set out below
-
delete, and do not share, any NZIC confidential information or personal information you might have obtained
-
keep information about any security issues with our systems that you discovered confidential between yourself and the NZIC until we have had an opportunity to fix it
Not accepted
-
findings from physical testing such as office access (e.g. open doors, tailgating)
-
findings derived primarily from social engineering (e.g. phishing, whaling)
-
findings from applications or systems not listed in the ‘In scope’ section
-
UI and UX bugs and spelling mistakes
-
network level Denial of Service (DoS/DDoS) weaknesses
-
destruction or corruption of (or attempts to destroy or corrupt) data or information that belongs to the NZIC
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.