Responsible disclosure policy

We welcome reports from anyone who finds a security weakness in our website or our apps. This policy says how to report one, what we ask of you and what we commit to in return.

What is in scope

• This website, cornerstonecyber.com.au, and its subdomains.
• The apps we run for our own business and for our customers.

Services we use but do not run, such as Microsoft 365, are out of scope. Report those to their provider.

How to report

Email security@cornerstonecyber.com.au with:

• what you found and where,
• the steps to reproduce it,
• what you think the impact is, and
• how we can reach you.

What we ask of you

• Do not access, change or delete data that is not yours. Stop and tell us as soon as you see anyone else's data.
• Do not run denial of service tests, social engineering or physical tests.
• Give us a reasonable time to fix the issue before you tell anyone else.

What we commit to

• We will acknowledge your report within two business days.
• We will tell you what we plan to do within ten business days and keep you updated until it is fixed.
• We will not take legal action against research carried out in good faith under this policy.
• With your agreement, we will thank you by name once the issue is fixed.

We do not run a paid bug bounty.

Last updated 30 October 2026. See also our trust centre.