Skip to content

Security Policy

Responsible disclosure policy for XCOM Space systems, infrastructure, and digital assets.

VERSION 1.0  |  EFFECTIVE 10 APRIL 2026  |  NEXT REVIEW APRIL 2027
// 01. Introduction
XCOM Space("XCOM Space") is an Australian space cybersecurity and resilience engineering company. We take the security of our systems and data seriously. We welcome responsible disclosure from the security research community and are committed to working collaboratively to resolve valid vulnerabilities in a timely and transparent manner.

This policy applies to all digital assets owned or operated by XCOM Space, including xcomspace.com and associated infrastructure.
// 02. Scope

In Scope

  • xcomspace.com — primary website and all subdomains
  • Email infrastructure — mail servers and DNS records associated with xcomspace.com
  • Cloud-hosted services — any publicly accessible API or service operated by XCOM Space
  • Authentication systems — login portals, session management, and access controls

Out of Scope

  • Third-party services not under XCOM Space's direct control (e.g. hosting providers, SaaS platforms)
  • Social engineering attacks against XCOM Space personnel
  • Physical security testing of XCOM Space premises
  • Denial of service (DoS/DDoS) attacks
  • Spam, phishing simulations, or automated scanning without prior consent
  • Vulnerabilities in software not developed or directly managed by XCOM Space
// 03. How to Report
Submit all vulnerability reports to: security@xcomspace.com

Please include the following in your report:

  • Description — clear explanation of the vulnerability
  • Impact — potential risk or severity assessment
  • Steps to reproduce — detailed reproduction steps or proof of concept
  • Affected systems — URL, endpoint, or component impacted
  • Your details — name/handle and contact information (for acknowledgment)
// 04. Response Timeline
DAY 1–2
Acknowledgement — We will confirm receipt of your report within 2 business days.
DAY 3–10
Triage — We will assess severity, confirm validity, and assign priority.
DAY 10–30
Remediation — We will work to resolve confirmed vulnerabilities. Complex issues may take longer — we will keep you informed.
DAY 90
Disclosure window — We ask researchers to allow up to 90 days before public disclosure. We will coordinate timing with you where possible.
// 05. Our Commitments to Researchers

Good Faith

We will not pursue legal action against researchers who act in good faith and comply with this policy.

Transparency

We will provide regular updates on the status of your report throughout the remediation process.

Acknowledgment

With your permission, we will publicly acknowledge your contribution on our Acknowledgments page.

Confidentiality

We will not share your personal details without your explicit consent.

// 06. Researcher Expectations
When conducting security research on XCOM Space systems, we ask that you:

  • Act in good faith — avoid actions that could harm XCOM Space or its clients
  • Do not access, modify, or delete data that does not belong to you
  • Do not disrupt production services or degrade performance
  • Limit testing to your own accounts or explicitly authorised test environments
  • Report findings promptly and allow reasonable remediation time before disclosure
  • Do not share vulnerability details with third parties prior to resolution
// 07. Legal Safe Harbour
XCOM Space will not initiate legal proceedings against researchers who:

  • Comply with this policy in full
  • Act in good faith without intent to cause harm
  • Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue
  • Report findings to XCOM Space before any public or third-party disclosure

This safe harbour applies to all applicable laws including the Australian Criminal Code Act 1995 (Part 10.7 — Computer Offences) in relation to good-faith security research conducted under this policy.

// Report a Vulnerability

Found something? We want to hear from you. Report responsibly and we'll work with you to fix it.

Contact Security Team

XCOM Space acknowledges the Traditional Custodians of the land on which we operate, the Gadigal people of the Eora Nation.

We recognise their continuing connection to land, waters, and community and pay our respects to Elders past and present.

We extend that respect to all Aboriginal and Torres Strait Islander peoples.