Optus Vulnerability Disclosure

generated: '2026-07-25'
method: searched
source: https://bugcrowd.com/optus-vdp-pro
probe: false
program:
  name: Optus Vulnerability Disclosure Program
  kind: vulnerability-disclosure-program
  platform: Bugcrowd
  url: https://bugcrowd.com/optus-vdp-pro
  alternate_url: https://bugcrowd.com/engagements/optus-vdp-pro
  http_status: 200
  page_title: 'Vulnerability Disclosure: Optus Vulnerability Disclosure Program - Bugcrowd'
  managed: true
  bounty: false
  note: >-
    Corporate-level program covering Optus (Singtel Optus Pty Limited). The program page is
    rendered client-side, so scope, safe-harbour wording, and response targets could not be
    read anonymously and are deliberately not reproduced here. Submissions are taken through
    Bugcrowd rather than a direct security@ mailbox.
policy:
- https://bugcrowd.com/optus-vdp-pro
contact: []
security_txt:
  published: false
  probed:
  - {url: 'https://www.optus.com.au/.well-known/security.txt', status: 404}
  - {url: 'https://optus.com.au/.well-known/security.txt', status: 404}
  - {url: 'https://sms.optus.com.au/.well-known/security.txt', status: 404}
  - {url: 'https://api.sms.optus.com.au/.well-known/security.txt', status: 404}
  note: >-
    No RFC 9116 security.txt is served on any Optus-controlled host. The only security.txt
    reachable under an optus.com.au name is on status.sms.optus.com.au, which is an Atlassian
    Statuspage tenant and serves Atlassian's own file (Contact -
    https://www.atlassian.com/trust/), not Optus's.
api_surface_note: >-
  The Optus SMS Suite developer surface at sms.optus.com.au publishes security guidance
  (TLS 1.2 minimum, IP allowlisting, SSL certificate rotation notices) at
  https://sms.optus.com.au/docs/en/security/ but does not carry its own disclosure policy;
  vulnerabilities in that surface fall under the corporate Bugcrowd program above and/or the
  platform operator, Modica Group.
evidence:
- {source: 'https://bugcrowd.com/optus-vdp-pro', kind: bug-bounty-platform, status: 200}
- {source: 'https://sms.optus.com.au/docs/en/security/', kind: security-guidance, status: 200}