Security

Last updated 27 October 2026.

Reporting a security issue

If you think you've found a security vulnerability in FIFOWorks, please email jobs@fifoworks.com.au with the subject “Security”. Include what you found, how to reproduce it, and the URL(s) involved.

What we commit to

• We'll acknowledge your report within 2 business days.
• We'll keep you updated, and fix confirmed issues by severity: critical within 7 days, high within 14 days, moderate within 30 days.
• We won't take legal action against good-faith research that follows this page.

Please

• Don't access, change or delete other people's data. Use only accounts you own.
• Don't run denial-of-service, spam or social-engineering tests, or automated scans that put load on the live site.
• Give us reasonable time to fix the issue before telling anyone else.

Out of scope

• Missing best-practice headers with no demonstrated impact.
• Reports from automated scanners alone.
• Issues in third-party services (report those to the vendor).

We don't run a paid bug bounty.

Thanks for helping keep FIFOWorks safe.

The FIFOWorks team