Penva Security
Book a scoping call

Found a vulnerability? Report it safely.

Help us protect Penva Security's systems. Here is what you can test, how to report a finding and what to expect from our response.

Email Security TeamCRESTOWASPSecured 100+ organisations4.9Clutch

Our response commitments

Know what happens next

For valid reports, we follow these timelines during Australian business hours.

Acknowledgement
48h
Status updates
14 days
Typical investigation
14-30 days
Disclosure window
90 days

We follow coordinated disclosure norms aligned to ISO/IEC 29147. The standard disclosure window can be extended by mutual agreement. We offer acknowledgement and credit with your consent, but do not currently offer monetary rewards.

Testing scope

Check the boundaries before you test

This policy covers systems operated by Penva Security. Client systems and third-party services have their own reporting channels.

In scope

Welcome under this policy

  • penvasecurity.com.au and all subdomains we operate
  • Client-facing portals and dashboards operated by Penva Security
  • Email infrastructure and authentication systems
  • Penva Security API endpoints and integration surfaces
  • Any infrastructure that processes client engagement data
Out of scope

Other channels apply

  • Third-party services Penva Security uses (report to those vendors directly)
  • Vulnerabilities in client systems Penva Security has tested (those are confidential to the client)
  • Social engineering of Penva Security staff (please don't)
  • Physical attacks on Penva Security offices or staff
  • Denial-of-service testing or volumetric attacks on Penva Security infrastructure
  • Vulnerabilities already disclosed publicly or known to Penva Security

Five-step process

From your report to a verified fix

We investigate, keep you informed and coordinate remediation and any public disclosure.

Send a Report by Email

Email [email protected] with the affected system, reproduction steps and potential impact. Send a non-sensitive summary first. Contact the security team to arrange a secure transfer before sharing sensitive evidence.

Wait for Acknowledgement (within 48 hours)

Penva Security commits to acknowledging valid disclosure reports within 48 hours of receipt during Australian business hours. The acknowledgement includes a tracking reference and an initial severity assessment.

Allow Investigation Time (typically 14-30 days)

Penva Security will investigate, reproduce, and validate the report. A typical investigation takes 14-30 days depending on complexity and the affected system. We'll provide status updates at least every 14 days throughout the investigation.

Remediation & Verification

Once validated, Penva Security will implement remediation and notify you when fixes are deployed. You're welcome (and encouraged) to verify the remediation with non-destructive testing aligned to the original report scope.

Coordinated Public Disclosure (optional, by mutual agreement)

Where appropriate, Penva Security supports coordinated public disclosure of confirmed vulnerabilities after remediation. The standard coordination window is 90 days from initial report, extendable by mutual agreement.

Good-faith research

Our safe harbour commitment

Protection applies to good-faith research conducted within this policy's scope and conditions.

Penva Security commits to safe harbour for good-faith security research conducted within the scope of this policy. We will not initiate legal action against researchers who: act in good faith to identify and report vulnerabilities, stay within the in-scope systems above, avoid destructive testing or accessing data beyond what's necessary to demonstrate the issue, and report findings to Penva Security before public disclosure.

What's outside safe harbour: intentional data exfiltration, social engineering of staff, denial-of-service attacks, attempting to access other users' data, public disclosure before the coordinated disclosure window, and any activity that violates Australian or applicable law beyond authorised security research.

If you're unsure whether something falls within scope or safe harbour, ask us first via the same security contact; we'd rather have a conversation upfront than navigate ambiguity later.

Report a vulnerability

Send your finding to our security team

Include the affected system, reproduction steps, impact and any supporting evidence.

We acknowledge valid reports within 48 hours during Australian business hours. We do not currently publish a PGP key. Email a non-sensitive summary first and arrange a secure transfer before sending sensitive evidence.

[email protected]View security.txt

Common questions

Responsible Disclosure: common questions

More detail on the policies, process and practical questions covered on this page.

Do you have a bug bounty program?
Not currently. Penva Security welcomes good-faith security research under coordinated vulnerability disclosure but does not currently offer monetary rewards. We acknowledge reporters publicly (with consent) and provide credit in any post-remediation disclosure. We may launch a formal bounty program in future - if you'd like to be notified when we do, mention it in your initial report.
What scope is acceptable for testing without explicit permission?
Non-destructive, good-faith testing of internet-exposed Penva Security systems for the purpose of identifying vulnerabilities to report under this policy is acceptable. This includes web application testing, API testing, configuration review, and observation of behaviour. Out of scope: anything that would degrade availability, exfiltrate non-trivial amounts of data, attempt social engineering, or access other users' data.
How does Penva Security treat researchers in good standing?
Researchers who report vulnerabilities under this policy in good faith are treated as trusted contributors. We do not pursue legal action against good-faith researchers for activities reasonably consistent with this policy. We commit to: acknowledging discovery, providing updates, crediting the reporter (with consent), and acting on the report in good faith.
What's your encryption / PGP key for sensitive reports?
We do not currently publish a PGP public key. Email [email protected] with a non-sensitive summary and ask the security team to arrange a secure transfer before sending sensitive evidence. Our security.txt file lists the security contact and disclosure policy.
What happens if I find a vulnerability in a Penva Security client's system, not Penva Security itself?
Report it to the affected client directly. Most modern organisations have their own responsible disclosure or bug bounty programs - check their /security.txt file or website. Don't report Penva Security clients' vulnerabilities to Penva Security - we cannot act on those reports and they're outside the scope of this policy. We respect the confidentiality of every engagement we've conducted.
Will you publish a CVE for valid findings?
For vulnerabilities affecting Penva Security's own custom software or systems, yes - we can coordinate CVE assignment through MITRE or a CNA where appropriate. For configuration issues, third-party software vulnerabilities, or issues that don't warrant a CVE, we'll work with you on appropriate disclosure timing without CVE assignment.
Do you accept reports about vulnerabilities in your published security research?
Yes - if you find errors, misrepresentations, or out-of-date information in Penva Security's published security research (blog posts, whitepapers, glossary entries), please report them via the same channel. We'll correct the record and credit the report as appropriate. Accuracy of our published material is a security-equivalent concern.
What if my report is rejected or you disagree about severity?
We'll explain our reasoning and engage in good-faith discussion. Severity assessments can be subjective and we welcome disagreement. If we can't reach agreement, you may consider escalating through coordinated disclosure bodies (CERT Australia, ASD's ACSC). We commit to professional engagement throughout.

Get In Touch

Talk through your penetration testing requirements

Book a scoping call or share your systems, priorities and deadlines with our team.

Book a scoping call

Choose a time that works for you.

30 min

Tell us what you need

Share your scope, priorities and deadline.

Share your scope and we'll help you plan the next step.

A clear next step

We'll review your requirements with you and confirm the scope before testing begins.

Prefer to get in touch directly? [email protected]