Vulnerability Disclosure Policy

1. Introduction

DreamIT Host welcomes reports of security vulnerabilities in our systems. If you believe you have found one, please tell us. We will work with you to understand and fix it.

2. Scope

In scope:

• websites and services operated by DreamIT Host under the domains dreamithost.com.au, dreamithost.au, dreamit.au, hosting-cloud.net and dreamitsolutions.com.au;
• DreamIT Host’s client portal and support systems;
• DreamIT Host’s hosting platform infrastructure.

Out of scope:

• websites and applications that our clients run on our hosting. Report those to the site owner. If you cannot reach them, tell us and we will pass the report on;
• third-party services we use, which have their own disclosure programmes;
• reports about missing best-practice headers or settings with no demonstrated security impact.

3. How to report

Email security@dreamit.au. Include:

• what you found and where;
• the steps to reproduce it;
• the impact you think it has;
• how to contact you.

Please do not include personal information you came across, beyond what is needed to show the issue.

4. What we will do

• Acknowledge your report within 3 business days.
• Give you an initial assessment within 10 business days.
• Keep you updated while we fix it.
• Tell you when it is fixed.
• Credit you, if you want, once it is fixed.

We do not offer payment for reports.

5. Rules for testing

When you look for vulnerabilities, please:

• do not access, change or delete data that is not yours, beyond the minimum needed to show the issue;
• do not run denial-of-service tests, or anything that degrades our services;
• do not use social engineering, phishing or physical attacks against our staff, clients or facilities;
• do not send spam or run automated scanning at a volume that affects service;
• stop and tell us as soon as you find a vulnerability or any client data.

Our servers block sources that make repeated failed logins or port scans. That is normal protection, not a response to your report.

6. Disclosure

Please give us a reasonable time to fix an issue before you disclose it publicly. We ask for 90 days from your report, or less if we fix it sooner. We will agree a date with you.

7. Good-faith research

If you act in good faith and follow this policy, we will not take legal action against you for your research, and we will not ask law enforcement to investigate you for it.

This does not cover actions that break the rules in section 5, or that break the law in other ways.