Responsible Disclosure Policy

Last updated: 15 September 2026

We welcome good-faith reports that help protect Member Hub and the people whose information it holds. We prioritise specific, actionable security issues with a credible impact on our service or users. You do not need to be a professional researcher to report something you have noticed.

Report vulnerabilities to security@memberhub.com.au. This is a disclosure channel, not an open invitation to scan or attack our systems. Obtain our written approval before active security testing. You do not need approval to report an issue discovered accidentally or during ordinary authorised use.

1. What makes a useful report

Explain what an attacker could do, the affected feature, and why the behaviour is a security issue. Useful reports might concern access to another organisation's records, an authentication or permission bypass, exposure of private files or credentials, or an injection flaw that affects another user or the server.

The following are generally not enough on their own to establish a vulnerability:

• Unreviewed scanner output or a generic list of recommended settings.
• An outdated JavaScript library, version banner or CVE reference without an explanation of how the vulnerable behaviour applies to Member Hub.
• Missing headers, cookie flags or other hardening suggestions without a credible security impact in the affected feature.
• A theoretical attack that assumes access or permissions the attacker already has, without showing an additional security boundary being crossed.

Automated tools can help identify real problems, and vulnerable dependencies can be serious. We assess the evidence and impact, not whether a tool was used. A safe reproduction or a clear explanation of an applicable vulnerable code path is useful; do not exploit a live system or access someone else's data to make a report more convincing. If further verification would be unsafe, send what you know and explain the uncertainty.

2. Testing permission and scope

Reports may concern Member Hub's website, web application, APIs or official mobile app. Before actively testing, email us with the exact systems, proposed methods, test accounts and timing. Wait for written approval that defines the permitted scope and limits; sending a request or receiving an acknowledgement is not approval.

An organisation's subscription or permission from one of its administrators does not authorise testing of our shared platform. Third-party providers, their infrastructure, and customer systems are outside our testing permission unless the relevant owner separately authorises them. We cannot grant permission on someone else's behalf.

Do not run unsolicited automated scans, bulk probing, brute-force or credential-stuffing attempts. Denial-of-service or load testing, phishing, social engineering and physical attacks are not permitted under this policy. Any approved use of automated tools must stay within the agreed targets, request rates and testing window.

3. Protect people and their information

• Use only accounts and test records expressly approved for the testing. Keep activity to the minimum needed to establish the issue safely.
• Do not alter or delete real records, send messages to real members, incur charges, disrupt operations, install persistence or use discovered credentials.
• If you encounter another person's information or unexpected access, stop testing and report it promptly. Do not explore further, enumerate accounts or download data.
• Retain only the minimum evidence needed, protect it from disclosure, and agree secure transfer and deletion with us. Do not retain customer data for your portfolio.

4. How to report

Email security@memberhub.com.au with the subject Security report: [brief description]. Where available, include:

• The affected URL, endpoint or app version, and when you observed the issue.
• Required access, account role and other conditions, without passwords or live tokens.
• Clear reproduction steps from permitted activity, expected behaviour and actual behaviour.
• The likely impact and minimal, redacted evidence, such as a screenshot or request/response.
• Any testing approval and a way to contact you with follow-up questions.

Do not email member records, passwords, active session tokens or a database export. If sensitive evidence is essential, describe what you have and ask us to arrange a suitable transfer method first. Pseudonymous reports are welcome; we may be unable to follow up if you do not provide a working reply address.

For ordinary account or product support, contact help@memberhub.com.au. For privacy requests or complaints, see our Privacy Policy.

5. How we respond

We review reports according to their credible impact and urgency. We aim to acknowledge actionable reports, ask for any necessary clarification and keep the reporter informed of material progress and the outcome. Response and remediation times depend on the issue; this policy does not promise a fixed response time or resolution date.

We may consolidate duplicate reports or close reports that do not establish a security issue. If you have new evidence of impact, reply to the original report. We cannot provide a detailed assessment of every generic scan or repeated submission.

We will not pursue legal action against someone solely for making a good-faith report, or for testing that complies with our written authorisation and this policy. If you accidentally go beyond the agreed scope, stop and tell us so we can assess what happened. This assurance does not authorise other activity or bind third parties or authorities.

6. Coordinating public disclosure

Please report privately first and give us a reasonable opportunity to investigate and protect affected users before publishing exploit details. Discuss a proposed disclosure date with us so we can coordinate remediation and any necessary customer notices. We do not ask for indefinite secrecy or restrict lawful reporting to authorities. Do not publish personal information, credentials or other people's confidential data.

7. Recognition and rewards

Member Hub does not currently offer a paid bug bounty. Submitting a report does not create an entitlement to payment, a public listing or a backlink. Do not make disclosure of the information needed to investigate conditional on payment or recognition.

We may introduce a public acknowledgements area for people whose original, verified reports help us resolve meaningful security vulnerabilities. Recognition would consider the report's impact, usefulness and responsible handling. With your consent, it could include your chosen name or alias and an agreed profile link after the issue is resolved and safe to acknowledge. We will not publish your identity or link without your permission.