Ausgrid Vulnerability Disclosure

generated: '2026-07-27'
method: searched
probe: true
source: https://www.ausgrid.com.au/outages-and-issues/customer-support/ausgrid-vulnerability-disclosure-program
policy:
- https://www.ausgrid.com.au/outages-and-issues/customer-support/ausgrid-vulnerability-disclosure-program
contact: []
channel: web-form
channel_detail: |
  Reports are submitted through a web form on the Vulnerability Disclosure Program
  page. Ausgrid publishes no security@ mailbox, no PGP key and no security.txt
  (https://www.ausgrid.com.au/.well-known/security.txt -> HTTP 404, re-verified
  2026-07-27). Submissions may be made anonymously or under a pseudonym. An urgent
  telephone line — 13 13 65 — is published on the same page.
bug_bounty: false
rewards: false
safe_harbour: not-stated
response_sla: not-stated
pgp_key: false
security_txt: false
requested_report_contents:
- reporter name and contact details (optional)
- brief description of the vulnerability
- date and time of discovery
- affected systems
- detailed description of the vulnerability and its security impact
- step-by-step reproduction instructions
- suggested fixes
prohibited_activities:
- attempting physical access to Ausgrid assets
- accessing or attempting to access accounts or data you are not authorised to access
- disclosing the vulnerability to third parties without Ausgrid approval
- exfiltrating, modifying or destroying data
- social engineering and phishing
- distributing malware
- denial-of-service attacks
- clickjacking
- any illegal activity
ineligible_reporters:
- employees and officers of Ausgrid
- contractors engaged by Ausgrid
evidence:
- source: https://www.ausgrid.com.au/outages-and-issues/customer-support/ausgrid-vulnerability-disclosure-program
  kind: disclosure-page
  status: 200
  checked: '2026-07-27'
- source: https://www.ausgrid.com.au/.well-known/security.txt
  kind: security.txt
  status: 404
  checked: '2026-07-27'
notes: |
  This is a critical-infrastructure operator with a published, no-bounty
  vulnerability disclosure program and no machine-readable security.txt. The single
  highest-value hygiene change Ausgrid could make is publishing RFC 9116
  /.well-known/security.txt pointing at this page.