Reporting a security problem

If you think you've found a security problem in TipJarr, our website or the member portal, please tell us. We would much rather hear it from you first.

How to report it

• Email [email protected] with Security in the subject line.
• Say what you found, where, and the steps to see it happen. Screenshots help.
• Don't send anyone else's personal information. If you saw some, describe it instead.

What we'll do

• Reply within 3 business days (Melbourne time) to say we have your report.
• Tell you within 10 business days what we think of it and what we plan to do.
• Fix serious problems as fast as we can, and tell you when the fix is live.
• Log every report and track it until it is fixed.
• Thank you publicly once it's fixed, if you'd like that. We don't pay for reports.

Our promise if you act in good faith

If you follow the rules below, we won't take legal action against you or ask anyone else to, and we'll treat your research as authorised. If anyone else takes action over research that followed these rules, we'll make it known that we authorised it.

• Only test with your own account. Never open, change or delete anyone else's information. If you reach some by accident, stop, and tell us.
• Don't slow the site down or try to take it offline, and don't run automated scans at volume.
• Don't send spam, trick our members or staff, or try to get into our offices or devices.
• Don't use what you find for anything except reporting it to us.
• Give us 90 days to fix a problem before you talk about it publicly, or tell us sooner if it is already being misused.

Not covered

Services we use but don't run, such as our payment, email and hosting providers. Please report problems with those to the provider. Reports about missing best-practice settings with no real effect are welcome, but may wait.