01 Our commitment to researchers
Security researchers make Digital Surge safer, and we want to hear from you. If you report a vulnerability in good faith and follow the rules on this page, we will:
- acknowledge your report and give you a point of contact
- keep you informed while we look into the issue and fix it
- tell you when the fix has shipped
- pay a bounty for valid, in-scope findings, sized to their severity
- credit you publicly if you would like us to
We have paid bounties for real findings before, and we will again. This is a program for security research, not a channel for account help. For anything about your own account, contact our support team.
02 What is in scope
- digitalsurge.com.au, this website
- app.digitalsurge.com.au, the Digital Surge web app, and the APIs behind it
- the Digital Surge apps for iOS and Android
Other systems Digital Surge operates are in scope for reporting, but check with us before you test anything not listed here.
Out of scope
- services hosted for us by third parties, such as our help centre at help.digitalsurge.com.au. Report those to the provider.
- social engineering or phishing of Digital Surge staff or customers
- physical attacks on offices, people or hardware
- denial of service, rate-limit testing, or anything that degrades service for others
- spam, and automated scanner output with no demonstrated impact
- missing security headers, cookie flags or best-practice settings with no exploitable impact
- clickjacking on pages with no sensitive actions
- self-XSS, and issues that need a rooted or jailbroken device or a user-installed certificate
- software version disclosure, and vulnerabilities in third-party libraries without a working exploit against us
- opinions about password, session or email policy with no demonstrated weakness
03 Rules of engagement
Keep your testing safe for our customers.
- Test only with accounts you own. Never access, change or delete another customer's data or funds. If you come across someone else's data by accident, stop, note what you need to describe the issue, and tell us.
- Stop at the minimum needed to prove the issue. Do not pivot further into our systems, do not exfiltrate data, and do not keep a copy of anything that is not yours.
- Do not move, withdraw or trade funds you do not own, even to demonstrate impact.
- No denial of service, no social engineering, no physical intrusion.
- Give us reasonable time to fix the issue before you talk about it publicly, and agree the timing with us first.
- Do not make a bounty a condition of reporting. Demanding payment before disclosing is extortion, not research.
- Keep within Australian law and the laws that apply where you are.
04 Safe harbour
If you follow these rules in good faith, we consider your research authorised. We will not pursue or support legal action against you for it. If a third party raises a claim about research you did under this policy, we will make it known that you acted in line with it. Where any part of this policy conflicts with a law that applies to you, you remain responsible for complying with that law.
05 How to report
Email contact@digitalsurge.com.au with "Security report" in the subject line. If your report includes sensitive detail, encrypt it with our PGP key below.
Include as much of this as you can:
- the URL, app or endpoint affected
- clear steps to reproduce, with requests, screenshots or a short video
- the impact as you understand it, and who it affects
- any accounts, IP addresses and timestamps you used, so we can match your activity in our logs
- how you would like to be credited, if at all
One issue per report, please. It keeps triage fast and makes sure each finding is assessed on its own.
06 What happens next
- Acknowledgement. We confirm we have your report and who is handling it.
- Triage. We reproduce the issue and rate its severity.
- Fix. We ship a fix and keep you updated along the way.
- Bounty. Once the issue is confirmed, we agree the reward and arrange payment.
- Disclosure. If you want to write up the finding, we agree the timing together, after the fix is live.
07 Bounties
We pay for valid, previously unknown, in-scope vulnerabilities. The amount depends on severity and real-world impact to customers, funds and data. We use CVSS as a guide, then apply our own judgement about what the issue means for the people who use Digital Surge.
| Severity | Typical examples |
|---|---|
| Critical | Access to customer funds, remote code execution, or exposure of large volumes of customer data |
| High | Account takeover of another customer, authentication or 2FA bypass, significant data exposure |
| Medium | Limited exposure of customer data, CSRF on sensitive actions, privilege escalation with narrow impact |
| Low | Minor issues with limited impact, such as information leaks that reveal no customer data |
A few ground rules on payment:
- The first clear report of an issue is the one we pay. Duplicates and issues we already know about are not paid.
- We pay once per underlying issue, even if it shows up in several places.
- Findings made outside the rules above, or against out-of-scope targets, are not paid.
- Digital Surge staff, contractors and their immediate families are not eligible.
- We may need to verify your identity before we pay, and you are responsible for any tax on the reward where you live.
- Severity and amount are decided by Digital Surge, and that decision is final.
08 Our PGP key
Encrypt sensitive reports to our key.
Fingerprint: 2462 C362 A800 7F92 7901 D4B4 297D 8C63 2215 95D0
Download the public key, or import it directly:
curl -s https://digitalsurge.com.au/.well-known/pgp-key.txt | gpg --import
Our security.txt carries the same contact details in the standard machine-readable format (RFC 9116).