Security at NZoffer
We welcome coordinated disclosure of security vulnerabilities. This page is the public form of our responsible-disclosure policy; it is also served as /.well-known/security.txt (RFC 9116).
Reporting an issue
Email security@offer.nz with a description of the vulnerability (what an attacker can do), reproduction steps with URLs and request bodies where applicable, the commit hash or app version if known, and your contact details if you would like updates. Reports in English, please. Do not open GitHub issues for security reports.
Scope
In scope: the production web app at offer.nz, the NZoffer mobile apps, and the API at api.offer.nz. Out of scope — please do not test: staging or development environments without prior coordination, third-party services we rely on, social engineering of NZoffer staff or merchants, physical attacks, and denial-of-service testing without prior coordination.
What you can expect
Acknowledgement within 2 business days; a triage update within 5 business days covering acceptance, severity, and an estimated remediation timeline; a final notification when the issue is fixed; and public credit in our release notes if you would like it — pseudonyms welcome.
| Severity | Examples | Target fix window |
|---|---|---|
| Critical | Authentication bypass, RCE, mass PII exposure | 24 hours |
| High | Privilege escalation, IDOR, broken redemption fraud control | 1 week |
| Medium | Persistent XSS, broken rate limit, sensitive data in error responses | 2 weeks |
| Low | Self-XSS, minor info disclosure, missing best-practice header | Backlog |
Safe harbour
We will not pursue legal action against researchers who make a good-faith effort to comply with this policy, avoid privacy violations, data destruction and service degradation, and give us reasonable time to respond before disclosing publicly. Please do not access another user's data beyond what is strictly necessary to prove the vulnerability, do not change data that is not yours, and allow up to 90 days for coordinated disclosure.
Typically out of scope
Missing security headers without a demonstrated attack, automated scanner output without a reproducible exploit, issues requiring physical device access, and best-practice notes without demonstrated impact are appreciated but not treated as security issues.