Security / Responsible Disclosure
PAR encourages responsible reporting of genuine security concerns through an authorised channel and expects good-faith research to avoid harm, privacy intrusion and service disruption.
Report responsibly.
Good faith
Report suspected vulnerabilities promptly and avoid exploiting them beyond what is necessary to demonstrate the issue.
No disruption
Do not degrade service availability, access other users’ information, or modify production data.
Confidential handling
Allow PAR a reasonable opportunity to investigate and remediate before public disclosure.
Approved channel
The production site should publish a dedicated security contact address and any supported reporting format.
Scope
Explicit in-scope and out-of-scope assets should be published once the production environment is finalised.
Security reporting should protect users first.
The purpose of responsible disclosure is to reduce risk and improve trust, not to expose users, partners or proprietary implementation.