Skip to content
AUSEC
Esc
  • Home/
  • Services/services/
  • Penetration testing/services/penetration-testing/
  • Vulnerability assessment/services/vulnerability-assessment/
  • Security audit/services/security-audit/
  • Compliance consulting/services/compliance-consulting/
  • Incident response and digital forensics/services/digital-forensics/
  • Corporate training and workshops/services/corporate-training/
  • Audit methodology/methodology/
  • Security posture quiz/#quiz
  • Threat Lab: attack simulator/threat-lab/#simulator
  • Threat Lab: cyber kill chain/threat-lab/#kill-chain
  • Threat Lab: defence in depth/threat-lab/#defence
  • Threat Lab: spot the phish/threat-lab/#phish
  • Threat Lab: terminal/threat-lab/#terminal
  • Frameworks hub/frameworks/
  • Framework cross-mapping/frameworks/#crossmap
  • PCI DSS v4.0.1/frameworks/pci-dss/
  • ISO/IEC 27001:2022/frameworks/iso-27001/
  • ISO/IEC 27002:2022/frameworks/iso-27002/
  • NIST Cybersecurity Framework 2.0/frameworks/nist-csf/
  • CERT-In Audit Guidelines (India)/frameworks/cert-in/
  • Training and internships/training/
  • Resources: articles and checklists/resources/
  • PCI DSS v4.0.1: what changed, and what it means now/resources/pci-dss-4-0-1-changes/
  • ISO/IEC 27001:2022 Annex A for beginners/resources/iso-27001-annex-a-beginners/
  • NIST CSF 2.0: the Govern function explained/resources/nist-csf-govern-function/
  • How to prepare for a CERT-In audit/resources/prepare-cert-in-audit/
  • Glossary/resources/#glossary
  • Team and certifications/team/
  • About Ausec/about/
  • Contact and book an assessment/contact/
  • Privacy policy/privacy/
  • Terms of use/terms/
  • Responsible disclosure/responsible-disclosure/
  • Design system/styleguide/

Responsible disclosure

Last updated

Draft responsible disclosure, pending legal review by Ausec. Not yet in force.

We test other organisations' security for a living, so we welcome reports about ours. If you believe you have found a vulnerability in a system Ausec operates, please tell us privately so we can fix it.

How to report

Email info@ausec.in with the subject "Security report". Our contact details are also published in /.well-known/security.txt. Please include:

  • The affected URL or system
  • A description of the issue and its potential impact
  • Step-by-step reproduction instructions, with screenshots or a proof of concept
  • How you would like to be credited, if at all

In scope

  • ausec.in and its subdomains operated by Ausec

Out of scope

  • Denial-of-service or load testing
  • Social engineering of our staff, or physical attacks on our office
  • Third-party services we use, such as our hosting or email providers; report those to the provider
  • Automated scanner output without a demonstrated impact
  • Missing best-practice headers or settings with no exploitable consequence

Please

  • Access only the minimum data needed to show the issue, and do not keep, share or modify it
  • Avoid degrading the service or affecting other users
  • Give us reasonable time to fix the issue before disclosing it publicly

Our commitment

We will acknowledge your report, keep you informed as we investigate and fix it, and credit you if you wish. We will not pursue legal action against good-faith research that follows this policy.