Security

We welcome reports of security vulnerabilities from good-faith researchers. If you believe you have found a security issue on infonews.co.nz, please tell us so we can fix it.

How to report

Email news@infonews.co.nz with the subject line starting with [SECURITY]. Please include:

• the affected URL or endpoint;
• the type of issue;
• clear, non-destructive steps to reproduce it;
• the impact you believe it has.

We do not operate a paid bug bounty or vulnerability disclosure program, and we cannot offer payment or a fixed response time. We review reports on a best-effort basis.

What is in scope

The infonews.co.nz website, its API, and the account and checkout flows on this domain.

What is out of scope

• Third-party services we rely on (for example Stripe, our email provider, and RSS distribution).
• Denial-of-service, volumetric, or brute-force testing.
• Social engineering and physical attacks.
• Automated scanner output with no demonstrated impact.
• Issues that are already known or have been reported before.

Safe harbour

We will not pursue or support legal action against researchers who act in good faith under this policy. To stay within it, only test against your own accounts, do not access, modify, or delete other people's data, do not disrupt the service, and give us reasonable time to fix an issue before disclosing it publicly. We aim to coordinate disclosure with you.

Thanks

With their permission, we acknowledge researchers who have responsibly reported a valid issue. This list is opt-in and implies no reward or payment.

No entries yet.