Simply Energy · Vulnerability Disclosure

Simply Energy Vulnerability Disclosure

Vulnerability disclosure

Simply Energy runs a coordinated vulnerability disclosure program on Hackerone. A machine-readable /.well-known/security.txt is served. A dedicated security contact is published.

EnergyAustraliaUtilitiesElectricityGasEnergy RetailConsumer Data RightCDRSmart MeteringEnergy Markets
Program: Hackerone security.txt present

Disclosure Policy

Policy
https://www.engie.com/en/cert/

Security Contact

Contact
mailto:cert@engie.com

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-07-27'
method: searched
probe: true
scope: engie-group
scope_note: |
  IMPORTANT PROVENANCE. Neither the Australian retail brand (simplyenergy.com.au,
  engie.com.au) nor either live CDR host (public.cdr.engie.com.au,
  cdr.energymadeeasy.gov.au) publishes a security.txt, a responsible-disclosure page or a bug
  bounty. `probe-security-programs.py` returned vdp=none for this provider on 2026-07-27, and
  every /.well-known/security.txt probe against those four hosts returned 404 or a Cloudflare
  403.

  What DOES exist is a group-level programme published by the ultimate parent, ENGIE SA
  (France): a PGP-signed RFC 9116 security.txt at https://www.engie.com/.well-known/security.txt
  and ENGIE CERT with a published RFC 2350 profile. The Australian entities trade as ENGIE and
  their endpoints sit on ENGIE-branded domains, so this is the route a researcher would
  realistically use to report a flaw in public.cdr.engie.com.au - but it is a PARENT-GROUP
  programme, not an Australian retail publication, and must not be reported as the latter.
policy:
- https://www.engie.com/en/cert/
contact:
- mailto:cert@engie.com
security_txt:
  url: https://www.engie.com/.well-known/security.txt
  file: well-known/simply-energy-engie-group-security.txt
  format: RFC 9116
  pgp_signed: true
  expires: '2027-07-03T00:00:00.000Z'
  encryption: https://www.engie.com/sites/default/files/assets/documents/2025-07/ENGIE%20CERT_0x13F8B408_public.asc
  preferred_languages: [en, fr]
csirt:
  name: ENGIE CERT
  rfc2350: https://www.engie.com/sites/default/files/assets/documents/2025-07/ENGIE-CERT-RFC%20%E2%80%93%20V1.5.pdf
  constituency: ENGIE Group
  reporting_preference: email, cryptographic keys requested for integrity and confidentiality
bug_bounty:
  program: none found
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
negative_findings:
- {host: 'https://public.cdr.engie.com.au/.well-known/security.txt', status: 404}
- {host: 'https://cdr.energymadeeasy.gov.au/.well-known/security.txt', status: 404}
- {host: 'https://engie.com.au/.well-known/security.txt', status: 403, note: Cloudflare blocks
    automated fetchers, so absence is unproven}
- {host: 'https://www.simplyenergy.com.au/.well-known/security.txt', status: 403, note:
    Cloudflare blocks automated fetchers, so absence is unproven}
- {check: 'probe-security-programs.py disclosure-page sweep', result: 'vdp=none'}
evidence:
- {source: 'https://www.engie.com/.well-known/security.txt', kind: security.txt, status: 200,
   fetched: '2026-07-27'}
- {source: 'https://www.engie.com/en/cert/', kind: csirt-page, status: 200, fetched: '2026-07-27'}
- {source: well-known/simply-energy-engie-group-security.txt, kind: harvested-file}
unrelated_contact_note: |
  CDR@help.engie.com.au is the Australian entity's Consumer Data Right enquiry address and
  privacy@help.engie.com.au its privacy officer. Neither is a security vulnerability reporting
  channel and neither is recorded as one.