PEXA · Vulnerability Disclosure

Pexa Vulnerability Disclosure

Vulnerability disclosure

PEXA runs a coordinated vulnerability disclosure program on Hackerone. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

Real-EstateAustraliaConveyancingProperty SettlementLand RegistryTitlePropTechMortgageDigital SigningWebhook

Program: Hackerone security.txt present

Disclosure Policy

Policy

https://www.pexa.com.au/security/

Security Contact

Contact

mailto:security@pexa.com.au

Source

Vulnerability Disclosure

generated: '2026-07-26'
method: searched
probe: true
source: https://www.pexa.com.au/.well-known/security.txt
policy:
- https://www.pexa.com.au/security/
contact:
- mailto:security@pexa.com.au
evidence:
- source: https://www.pexa.com.au/.well-known/security.txt
  kind: security.txt (live probe, HTTP 200, text/plain)
- source: https://www.pexa.com.au/security/
  kind: security policy page (HTTP 200)
security_txt_file: well-known/pexa-security.txt
security_txt:
  contact: mailto:security@pexa.com.au
  expires: '2026-09-03T23:59:59+10:00'
  preferred_language: en
  policy: https://www.pexa.com.au/security/
  canonical: https://pexa.com.au/.well-known/security.txt
  rfc: RFC 9116
policy_page:
  url: https://www.pexa.com.au/security/
  status: 200
  title: PEXA Security Assurance
  covers:
  - report suspicious emails to security@pexa.com.au
  - caller verification via 03 7002 4500
  - PEXA Support Centre 1300 084 515
  - business cyber-security guidance
  - PEXA Residential Seller Guarantee (fraud protection for sellers)
  - PEXA Key app for secure communication of bank account details
bug_bounty:
  program: null
  platform: null
  note: No public bug bounty was found on HackerOne, Bugcrowd or Intigriti, and no safe-harbour or reward terms
    are published. The disclosure route is the security.txt contact address and the security page.
negative_findings:
- https://trust.pexa.com.au/ does not resolve
- https://security.pexa.com.au/ does not resolve
- https://api.pexa.com.au/.well-known/security.txt returns 404
- No named certification (SOC 2, ISO 27001, PCI DSS) is asserted on any PEXA public page

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/pexa-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.