Responsible disclosure
Found a security issue? Email info@staktech.com.au with SECURITY in the subject.
Include the affected location, impact and minimal steps to reproduce. Report privately and give us reasonable time to investigate before public disclosure. Contact details are also in security.txt.
Testing boundaries
This policy covers www.vitalshealth.com.au and app.vitalshealth.com.au, including the app’s APIs. Use only your own account and data, and stop once an issue is confirmed. Do not perform denial-of-service testing, social engineering, automated scanning without agreement, or testing of third-party services.
If you encounter someone else’s information, stop immediately. Do not download, copy, retain or share it. Describe the type of exposure without including its contents and notify us promptly.
Our response
We acknowledge reports within five business days and provide an initial assessment within 14 days. We coordinate fixes or mitigations before public disclosure and offer credit for valid reports if wanted. There is no paid bounty programme.
Good-faith research
Research that follows these boundaries is authorised. We will not pursue civil or criminal action for activity consistent with this policy and will make that authorisation clear if a third party raises a concern. We cannot bind third parties or authorise access to their services.
Read our data-protection approach and Privacy Policy for more information.
Last updated