In scope
Security issues affecting the public .auDO site, .auDO-operated evidence or status surfaces, access controls protecting gated .auDO routes, and other infrastructure operated specifically for the observatory.
Security and vulnerability disclosure
Report security issues affecting services and infrastructure operated by the .au Domain Observatory.
Observed third-party domains remain outside this policy. Public observation does not make .auDO their security contact or authorise testing of their systems.
Scope
A deliberately narrow security boundary
Security reports are welcome when they concern .auDO-operated services. The observatory boundary stays separate from the organisations and domains it observes.
Third-party domains are not in scope
Domains and organisations observed by .auDO remain under their own security and operational control. A visible signal or possible issue relating to a third party should be reported to that organisation through its own published security contact.
Public evidence is not an invitation to test third parties. .auDO publishes bounded observations from public domain-layer signals. Inclusion in the panel, a report or a gated investigation view does not authorise security testing of an observed organisation or its systems.
Useful reports
What to include
A useful report makes the issue easier to verify while minimising unnecessary disclosure.
Describe the affected surface
Include the URL or service, the behaviour you observed and why you believe it creates a security concern.
Provide reproducible steps
Include a minimal sequence, relevant request details and environment information where that helps reproduce the behaviour.
Bound the evidence
Share only the data needed to demonstrate the issue. Do not send unrelated credentials, personal information or third-party data.
Suggest impact cautiously
Describe what you can demonstrate. Avoid assuming access, compromise or impact that has not been observed.
Handling
Assessment, containment and correction
Reports will be assessed against the evidence available and the role of the affected service. Where a material issue is confirmed, .auDO will prioritise proportionate containment or correction and preserve enough information to understand what changed.
Please avoid public disclosure of a suspected issue while it is being assessed where early disclosure would materially increase the risk to the service or its users. This request does not prevent good-faith reporting, independent discussion of already-public information or disclosure required by law.
Related governance. Security is one part of the wider trust surface. See Trust and transparency, Privacy, Methodology and Terms / Disclaimer.