Endeavour Group is Australia’s largest retail drinks network & portfolio of licensed hotels. Find information for employees, community, investors, suppliers & industry
External Program
Submit bugs directly to this organization
The Vulnerability Disclosure Policy provides guidance on how independent security researchers can advise Endeavour Group of any potential or identified security vulnerabilities within Endeavour Group.
If you have any questions regarding its contents, we invite you to contact our Privacy Officer, whose contact details are contained in Section 17 below.
This Vulnerability Disclosure policy applies to independent security researchers for any internet facing systems or Software as a Service (SaaS) cloud services.
Endeavour Group holds significant amounts of information about our customers, Team Members, business partners and the communities we serve. We are entrusted with this information and care about protecting it. The security researcher community makes valuable contributions to the security of an organisation and we at Endeavour Group are eager to maintain a good relationship with this community. This relationship will help us to improve our own security.
If you believe you have discovered a security weakness (vulnerability), or potential security weakness, within Endeavour Group please report it to [email protected] as quickly as possible.
We will try to address all identified issues in a timely manner and ask that you allow us a reasonable timeframe to review and address the issue before it is publicly disclosed. Details of any potential security vulnerabilities must not be publicly disclosed without our express written consent from an appropriately authorised endeavour group employee.
It will be viewed as a collaboration if security vulnerabilities are reported to us in accordance with this policy. In the event that a security vulnerability is not reported in accordance with this policy, we reserve all of our legal rights.
We acknowledge that responsible security research will occur and will work with the security research community.
The following list, which is not exhaustive, contains the types of techniques that are not permitted during research activities:
To report a security vulnerability to the Endeavour Group Cyber Security team email [email protected] with the subject: INDEPENDENT SECURITY RESEARCHER ADVISORY.
Please include as much information as possible to help us reproduce the vulnerability. This includes, but is not limited to:
When a report is made for a new vulnerability, we ask that you keep the information confidential and do not make your research public until we have completed our investigation and where applicable, have remediated or mitigated the vulnerability.
Once a security vulnerability has been reported we will aim to respond to you with an initial response within 5 business days. We will keep you informed of our progress on addressing the potential vulnerability. We will also inform you when the vulnerability has been remediated or mitigated.
We do not compensate individuals or organisations for identifying potential or confirmed security vulnerabilities but we will publicly recognise the researchers who discovered the vulnerability, subject to their consent.
Below are the names or aliases of researchers who have identified and disclosed security vulnerabilities to us in accordance with our Vulnerability Disclosure Policy.