Vulnerability Disclosure Policy

Effective 27 March 2026. At Intrix, we take the security of our infrastructure, products, and services seriously. This policy outlines how security researchers, clients, partners, and members of the public should report vulnerabilities discovered in Intrix systems — and what they can expect from us in return.  We encourage responsible disclosure. There is no financial reward programme at this time.

1. Scope

1.1 This policy applies to vulnerabilities discovered in any of the following Intrix-owned or operated systems, products, and services:
(a) Intrix Website and Client Portal – intrix.com.au and any associated subdomains, contact forms, and web applications;
(b) Attack Insights – Intrix’s Enterprise Attack Surface Management platform;
(c) DarkThreatX – Intrix’s Deep Dark Web Monitoring Platform;
(d) Criminal IP Integration – Intrix’s Cyber Threat Intelligence Platform;
(e) Intrix Internal Infrastructure – internal systems, networks, and cloud environments operated by Intrix in the delivery of its managed security services; and
(f) APIs and Integrations – any APIs, webhooks, or integration endpoints published or operated by Intrix.

1.2 This policy does not apply to:
(a) systems, networks, or environments belonging to Intrix clients – these are governed by the applicable client engagement agreement;
(b) third-party products or services that Intrix resells or integrates, unless the vulnerability directly affects an Intrix-operated instance; or
(c) vulnerabilities arising from client-supplied configurations or data provided to Intrix for testing purposes.

1.3 The following are explicitly out of scope and will not be investigated:
(a) SSL/TLS configuration observations such as weak cipher suites or certificate transparency log entries, unless a directly exploitable risk can be demonstrated with a working proof of concept;
(b) missing HTTP security headers, including CSP, HSTS, or X-Frame-Options, unless a working exploit demonstrating concrete harm can be provided;
(c) content spoofing, tabnapping, or disclosure of publicly available non-sensitive information;
(d) password autocomplete on login forms;
(e) clickjacking or UI redressing on pages that do not perform sensitive actions;
(f) self-XSS or vulnerabilities requiring significant user interaction or physical access;
(g) rate limiting or account enumeration observations without a demonstrated exploitable outcome;
(h) social engineering or phishing attacks targeting Intrix staff, clients, or partners;
(i) physical attacks on Intrix offices, personnel, or hardware;
(j) denial of service (DoS) or DDoS attacks, unless they reveal a previously unknown and independently exploitable security flaw; and
(k) vulnerabilities in third-party libraries or upstream dependencies unless they directly and demonstrably affect an Intrix-operated system in a way Intrix can independently remediate.

1.4 If you are uncertain whether an issue falls within scope, please submit it. We would rather review an out-of-scope report than have a genuine vulnerability go unreported.

2. How to Report a Vulnerability

2.1 If you believe you have discovered a security vulnerability within the scope defined in Section 1, please report it to us promptly and confidentially before disclosing it publicly or to any third party.

2.2 Submit all vulnerability reports to our security team by email at: info@intrix.com.au
For reports containing sensitive technical details, exploit code, or credential information, we strongly encourage encrypted communication. Please contact us first to request our PGP public key.

2.3 Your report should include the following where available:
(a) a clear description of the vulnerability, including its type using recognised classifications such as the OWASP Top 10, CWE identifiers, or CVSS categories (for example: SQL Injection, IDOR, SSRF, Stored XSS, Authentication Bypass, Privilege Escalation);
(b) the specific Intrix system, product, URL, API endpoint, or version affected;
(c) step-by-step instructions sufficient for Intrix to reliably reproduce the vulnerability;
(d) proof-of-concept code, screenshots, video recordings, HTTP request/response captures, or other supporting technical evidence – keeping any demonstration benign and non-destructive;
(e) an assessment of the potential business impact if exploited, including what data, systems, or users could be affected;
(f) whether you believe the vulnerability is currently being actively exploited; and
(g) your name or handle and preferred contact email address, if you wish to be credited in any published advisory.

2.4 Anonymous reports are accepted. However, providing contact details allows us to follow up if we require clarification and to credit you upon public disclosure.

2.5 Please do not submit vulnerability reports through general support channels, social media, or publicly accessible platforms. Reports submitted outside of info@intrix.com.au may not receive a timely or appropriate response.

3. Researcher Guidelines

3.1 We ask that all researchers act in good faith and adhere to the following guidelines throughout their research and disclosure process.

3.2 Researchers must:
(a) limit testing strictly to systems and assets within the scope defined in Section 1;
(b) conduct all testing in a manner that minimises disruption to Intrix services and has no impact on any Intrix client environments;
(c) avoid accessing, modifying, copying, exfiltrating, or retaining any data beyond the minimum strictly necessary to demonstrate the existence and impact of the vulnerability;
(d) cease testing immediately upon discovering evidence of access to personal information, client data, or sensitive credentials, and report this to Intrix without delay; and
(e) refrain from publicly disclosing or sharing details of the vulnerability with any third party before Intrix has had a reasonable opportunity to investigate, remediate, and coordinate disclosure.

3.3 Researchers must not:
(a) conduct any form of social engineering, phishing, vishing, or impersonation targeting Intrix staff, contractors, or clients;
(b) perform any physical security testing, including attempts to access Intrix premises, hardware, or personnel;
(c) conduct denial of service testing, load testing, or automated scanning at a rate likely to degrade the availability of Intrix services;
(d) exploit any vulnerability beyond what is necessary to confirm its existence and assess its impact;
(e) introduce malware, backdoors, ransomware, or any malicious code into Intrix systems or environments; or
(f) attempt to access, test, or interact with any systems belonging to Intrix clients, even if those systems are reachable from an Intrix environment.

3.4 Researchers must comply with all applicable Australian and international laws at all times, including the Criminal Code Act 1995 (Cth), the Privacy Act 1988 (Cth), and equivalent legislation in the researcher’s jurisdiction. This policy does not authorise any activity that is unlawful under applicable law.

4. Our Commitments

4.1 Intrix commits to the following in response to vulnerability reports submitted in accordance with this policy:

(a) Acknowledgement – we will acknowledge receipt of your report within 2 business days of submission;

(b) Initial Assessment – we will provide an initial assessment, including a preliminary scope determination and severity rating, within 5 business days of receipt;

(c) Progress Updates – we will keep you informed of the status of investigation and remediation at reasonable intervals, including any revision to our severity rating or timeline;

(d) Remediation Notification – we will notify you when the vulnerability has been remediated or mitigated;

(e) Public Credit – where a valid vulnerability is confirmed and publicly disclosed, we will credit you by name or handle in the published security advisory, unless you prefer to remain anonymous; and

(f) Safe Harbour – we will not pursue civil or criminal legal action against researchers who identify and report vulnerabilities in good faith, in accordance with this policy and within the scope and guidelines of Sections 1 and 3.

4.2 Intrix will handle all vulnerability reports in strict confidence. We will not share your personal details, contact information, or the technical contents of your report with any third party without your consent, except as required by law.

4.3 Intrix does not commit to any specific response SLA beyond those set out in clause 4.1. Response times may vary based on the complexity, severity, and volume of reports received.

5. CVE Assignment

7.1 Where a confirmed vulnerability meets the criteria for a CVE identifier under the CVE Programme administered by MITRE, Intrix will coordinate the assignment of a CVE ID in connection with public disclosure.

7.2 CVE IDs follow the standard format: CVE-[Year]-[Sequence Number].

7.3 Where the vulnerability affects a third-party product, Intrix will coordinate with the relevant vendor or CVE Numbering Authority (CNA) for assignment.

7.4 Reporters who identify a CVE-qualifying vulnerability will be credited in the CVE entry and in the corresponding Intrix security advisory, unless they prefer to remain anonymous.

6. Out-of-Scope Conduct and Disqualification

8.1 Reports that involve any of the following conduct will be immediately disqualified and will not receive safe harbour protections under clause 4.1(f):

(a) accessing, exfiltrating, modifying, or destroying data beyond what is strictly necessary to demonstrate the vulnerability;
(b) accessing or interacting with any Intrix client systems or environments;
(c) deliberately causing disruption to Intrix services or operations;
(d) submitting false, fabricated, or misleading vulnerability reports;
(e) threatening Intrix or demanding payment in exchange for vulnerability information or non-disclosure;
(f) publicly disclosing a vulnerability before Intrix has had a reasonable opportunity to respond and remediate; or
(g) violating any applicable Australian or international law in the course of research or submission.

8.2 Intrix reserves the right to refer reports involving conduct described in clause 8.1 to the Australian Federal Police, the Australian Cyber Security Centre (ACSC), or other relevant authorities.

7. Relationship to Client Engagements

9.1 This policy governs unsolicited vulnerability reports relating to Intrix’s own systems, products, and infrastructure. It does not apply to security testing conducted by Intrix consultants on behalf of clients, which is governed by the applicable engagement agreement and scope of work.

9.2 Security researchers who discover vulnerabilities in Intrix client environments should not attempt to test, exploit, or report those vulnerabilities under this policy. Researchers should contact the relevant client organisation directly through appropriate channels.

9.3 Intrix assists organisations in developing and implementing their own Vulnerability Disclosure Policies as part of its GRC advisory services. Organisations seeking to establish their own VDP are welcome to contact us at intrix.com.au/contact.

8. Acknowledgements

Intrix would like to thank the following security researchers who have responsibly disclosed vulnerabilities in accordance with this policy:

No acknowledgements to date. Be the first to report a valid vulnerability and receive your credit here.

9. Contact

Security Reports: info@intrix.com.au

General Enquiries: intrix.com.au/contact

Phone: 1300 931 727

24/7 Emergency Incident Response: intrix.com.au/247-cyber-incident-response-services

Security Advisories: intrix.com.au/security/advisories

Monthly Security Bulletins: intrix.com.au/security/bulletins

Response time: 2 business days for all vulnerability reports submitted to info@intrix.com.au.

This policy was last reviewed and updated on 27 March 2026.