Security and Vulnerability Disclosure Policy Draft
Kellridge Pty Ltd (ACN 703 624 202, ABN 39 703 624 202), a proprietary company incorporated in New South Wales, Australia — kellridge.com/security Version: Draft 0.1 — not yet approved or published (27 Oct 2026)
We welcome reports from security researchers and members of the public who find a possible vulnerability in our systems. This policy explains what is in scope, how to report, and what you can expect from us.
Scope
In scope
kellridge.comandwww.kellridge.com(static website hosted on Cloudflare Pages)- Email security configuration for the
kellridge.comdomain (e.g. SPF, DKIM, DMARC, MTA-STS) - DNS configuration for
kellridge.com
Out of scope
- The platforms of Cloudflare, Microsoft or other providers. Please report those to the provider directly.
- Findings with no realistic security impact, such as missing headers that don't create a weakness, version banners, clickjacking on pages with no sensitive actions, or best-practice reports from automated scanners without a demonstrated issue
- Volume-based denial-of-service
- Social engineering, phishing or physical attacks against Kellridge, our staff or our providers
How to report
Email security@kellridge.com with:
- a description of the issue and its likely impact;
- the steps to reproduce it, including affected URLs; and
- any proof-of-concept, screenshots or logs.
Please write in English and include how you would like to be credited, if at all. [to confirm — encryption key; until a PGP key is published, please don't send sensitive data by email and say in your first message that you need a secure channel]
What not to do
- Do not access, change, delete or download data that isn't yours, or more data than you need to show the issue.
- Do not run denial-of-service attacks, spam or heavy automated scanning that degrades the service.
- Do not use social engineering, phishing or physical intrusion.
- Do not keep a persistent foothold, or move on to other systems.
- Do not disclose the issue publicly until we have fixed it or 90 days have passed, whichever comes first, unless we agree otherwise.
- Do not ask for payment in exchange for withholding a report.
Safe harbour
If you make a good-faith effort to follow this policy, we will:
- treat your research as authorised in so far as Kellridge is able to authorise it;
- not take, or support, legal action against you for it; and
- tell anyone who raises a complaint that you acted under this policy.
We cannot authorise testing of third-party systems, such as Cloudflare or Microsoft, and cannot waive the rights of third parties or of law enforcement. If you are unsure whether something is allowed, ask us first. [to confirm on legal advice — safe harbour wording, including how it interacts with the Criminal Code Act 1995 (Cth) Part 10.7, the UK Computer Misuse Act 1990 and similar laws]
What to expect from us
| Stage | Target |
|---|---|
| Acknowledge your report | within 3 business days (Sydney time) |
| Initial assessment and severity | within 10 business days |
| Fix or mitigation | critical and high issues: as soon as possible, aiming for 30 days; others: 90 days |
| Updates | at least every 14 days until resolved |
We are a small firm, so these are targets, not guarantees. We do not currently offer a paid bug bounty. With your permission, we will thank you publicly once the issue is resolved.
If a report involves personal information, we will handle it under our Privacy Notice and meet any breach notification duties.
security.txt
Our security.txt file (RFC 9116) is published at https://kellridge.com/.well-known/security.txt and contains:
Contact: mailto:security@kellridge.com
Expires: 2027-10-27T00:00:00.000Z
Preferred-Languages: en
Canonical: https://kellridge.com/.well-known/security.txt
Policy: https://kellridge.com/security