# NexPay security disclosure policy
# https://nexpay.com.au/trust/

Contact: mailto:security@nexpay.com.au
Expires: 2027-05-05T23:59:59.000Z
Preferred-Languages: en
Canonical: https://nexpay.com.au/.well-known/security.txt
Policy: https://nexpay.com.au/trust/

# Thank you for taking the time to responsibly disclose a vulnerability.
# Please include a description of the issue, reproduction steps, and the
# impact you observed. We aim to acknowledge reports within one business
# day and provide a triage update within five.
#
# In scope:
#   - nexpay.com.au and subdomains
#   - app.nexpay.com.au
#   - api.nexpay.com.au
#
# Out of scope:
#   - Denial of service / volumetric attacks
#   - Findings derived from social engineering of NexPay staff or customers
#   - Reports that require physical access to a user's device