Found something? Tell us first.

Email support@claused.com.au with:

• A description of the issue and its potential impact.
• Steps to reproduce — proof-of-concept code is appreciated but not required.
• The URL, parameter, or feature affected.
• Your name or handle if you'd like to be credited in our public acknowledgements.

We aim to acknowledge reports within two business days and to provide an initial assessment within seven. Critical issues are triaged faster.

• claused.com.au and all subdomains
• The claused. web application and authenticated user flows
• The portal at /portal/*
• The public API (once shipped — see ROADMAP-v2.md X1)
• Mobile evidence-capture endpoints under /m/*

• Denial-of-service / volumetric attacks
• Social engineering of claused. staff, contractors, or customers
• Physical attacks against our infrastructure or offices
• Issues only reproducible on outdated browsers, jailbroken / rooted devices, or unpatched operating systems
• Reports purely about email-spoofing (SPF/DKIM/DMARC) without a demonstrable impact path
• Automated scanner output without manual validation and a working proof of concept

If you make a good-faith effort to comply with this policy during your research, we will not pursue legal action against you and will work with you to understand and resolve the issue quickly. Good faith means:

• You don't access, modify, or destroy data that isn't yours.
• You stop testing and report immediately once you've confirmed an issue.
• You don't publicly disclose before we've had time to fix.
• You don't extort or threaten us with disclosure.

claused. does not currently offer monetary bounties. We are happy to credit researchers publicly with their permission, and to provide swag and reference letters where useful.

For transparency, the platform is built on:

• Next.js hosted on Vercel (TLS, DDoS protection, WAF at the edge)
• Supabase Postgres in ap-southeast-2 (Sydney) — AES-256 encryption at rest, Row Level Security on all tables containing customer data
• Reducto for document parsing, Anthropic Claude for extraction, Voyage AI for embeddings — all under data-processing agreements
• Bcrypt for any non-Supabase password / PIN hashing
• MFA available via Supabase Auth (rolling out — see ROADMAP-v2.md S1)
• Automated dependency scanning via Dependabot; secret scanning via Gitleaks on every push
• Synthetic health-check monitoring runs hourly against production and notifies on regression