Advertiser disclosure

Vulnerability Disclosure Policy

We take the security of our customers' data very seriously. If you believe you've discovered a potential security vulnerability within one of our services or products, we strongly encourage you disclose it to us as quickly as possible and in a responsible manner.

We appreciate the assistance and patience of security researchers and we are committed to reviewing all reports that are disclosed to us.

We will do our best to address each issue in a timely fashion, and request that you provide us with a reasonable timeframe to address the issue before public disclosure.

Please do not publicly disclose the details of any potential security vulnerabilities without express written consent from us.

Policy Scope

We encourage you to conduct responsible security research on those of our products and services to which you have authorised access.

The following types of research are strictly prohibited:

• Accessing or attempting to access accounts or data that does not belong to you
• Any attempt to modify or destroy data
• Executing or attempting to execute a denial of service (DoS) attack
• Sending or attempting to send unsolicited or unauthorised email, spam or any other form of unsolicited messages
• Conducting social engineering (including phishing) of "Finder" employees, contractors or customers or any other party
• Any physical attempts against our property or data centres, including (but not limited to) distribution facilities, offices
• Posting, transmitting, uploading, linking to, sending or storing malware, viruses or similar harmful software that could impact our services, products or customers or any other party
• Testing third party websites, applications or services that integrate with our services or products
• Any activity that violates any law

The following vulnerability types are excluded from this Responsible Disclosure Program:

• Descriptive error messages such as stack traces, application or server errors
• HTTP 404 codes or pages, or other HTTP non-200 codes or pages
• Fingerprinting or banner disclosure on common and public services
• Disclosure of known public files, directories or endpoints, such as robots.txt
• Clickjacking and other issues only exploitable through clickjacking
• CSRF on forms that are available to anonymous users, such as contact, login and logout forms
• Unvalidated Redirects and Forward spoofing that would redirect a request to an untrusted URL, domain or website
• Presence of application or web browser 'autocomplete' or 'save password' functionality
• Lack of Secure or HTTPOnly flags on non-sensitive cookies
• Login or Forgot Password page brute force and account lockout not enforced
• OPTIONS HTTP method enabled
• Missing HTTP security headers, such as Strict Transport Security, X-Frame-Options, X-SSS-Protection, etc.
• HTTP or DNS cache poisoning
• Weak or insecure SSL cipher suites
• Self-XSS

Safe Harbour

To encourage responsible disclosure, we will not take legal action against security researchers in relation to the discovery and reporting of a potential security vulnerability.

This is provided that all such potential security vulnerabilities are discovered and reported strictly in accordance with this Responsible Disclosure Program.

In the event of any non-compliance, we reserve all of our legal rights.

If in doubt, please contact the "Finder" Security Team by sending an email to mailto:[email protected].

Communication Process - How to Report a Potential Security Vulnerability

You can responsibly disclose potential security vulnerabilities to the "Finder" Security Team by emailing mailto:[email protected].

Ensure that you include details of the potential security vulnerability and exploit with enough information to enable the Security Team to reproduce your steps.

Your email to us should contain:

• An explanation of the potential security vulnerability;
• A list of products and services that may be affected (where possible);
• Steps to reproduce the vulnerability;
• Proof-of-concept code (where applicable);
• The names of any test accounts you have created (where applicable); and
• Your contact information.

What happens next?

Once you have reported a potential security vulnerability, we will contact you within 72 hours with an initial response.

Going forward, we will keep you informed on our progress towards addressing the potential security vulnerability and will also notify you when the matter has been addressed.

We ask that you maintain confidentiality and do not make your research public until we have completed our investigation and, if necessary, re-mediated or mitigated the potential security vulnerability.

Please note that we do not compensate individuals or organisations for identifying potential or confirmed security vulnerabilities.

Any requests for monetary or other compensation will be deemed in violation of this Responsible Disclosure Program.

)

Was this content helpful to you?

Yes

No

Thank you for your feedback!

Get rewarded $$ for switching with Finder Rewards

Find a better deal, save on your bills and get a free gift card. Sign up to be the first to hear about new Finder Rewards.

SIGN UP

×

Important information about this website

Finder makes money from [/why-trust-us#how-we-make-money](featured partners), but editorial opinions are our own.

Advertiser disclosure

Finder is one of Australia's leading comparison websites. We are committed to our readers and stand by our [https://www.finder.com.au/editorial-guidelines](editorial principles).

We try to take an open and transparent approach and provide a broad-based comparison service. However, you should be aware that while we are an independently owned service, our comparison service does not include all providers or all products available in the market.

Some product issuers may provide products or offer services through multiple brands, associated companies or different labeling arrangements. This can make it difficult for consumers to compare alternatives or identify the companies behind the products. However, we aim to provide information to enable consumers to understand these issues.

How we make money

We make money by [https://www.finder.com.au/why-trust-us#how-we-make-money](featuring products) on our site. Compensation received from the providers featured on our site can influence which products we write about as well as where and how products appear on our page, but the order or placement of these products does not influence our assessment or opinions of them, nor is it an endorsement or recommendation for them.

Products marked as 'Top Pick', 'Promoted' or 'Advertisement' are prominently displayed either as a result of a commercial advertising arrangement or to highlight a particular product, provider or feature. Finder may receive remuneration from the Provider if you click on the related link, purchase or enquire about the product. Finder's decision to show a 'promoted' product is neither a recommendation that the product is appropriate for you nor an indication that the product is the best in its category. We encourage you to use the tools and information we provide to compare your options.

Where our site links to particular products or displays 'Go to site' buttons, we may receive a commission, referral fee or payment when you click on those buttons or apply for a product.

Sorting and ranking products

When products are grouped in a table or list, the order in which they are initially sorted may be influenced by a range of factors including price, fees and discounts; commercial partnerships; product features; and brand popularity. We provide tools so you can sort and filter these lists to highlight features that matter to you.

Terms of service and privacy policy

Please read our website [https://www.finder.com.au/terms-of-service](terms of use) and [https://www.finder.com.au/finder-group-privacy-cookies-policy](privacy policy) for more information about our services and our approach to privacy.

#

We update our data regularly, but information can change between updates. Confirm details with the provider you're interested in before making a decision.

[https://www.finder.com.au/why-trust-us](Learn how we maintain accuracy on our site).

How likely would you be to recommend Finder to a friend or colleague?

0

1

2

3

4

5

6

7

8

9

10

Very Unlikely Extremely Likely

Required

Submit

What is your feedback about?

What is your feedback about? Site speed Content quality Ease of use Ease of finding information Site appearance Other

Required

Please tell us how we can improve

Required

Submit

Thank you for your feedback.

Our goal is to create the best possible product, and your thoughts, ideas and suggestions play a major role in helping us identify opportunities to improve.

[/hpot?ref=](Go to site)

We use cookies to optimise our site and allow us and 3rd parties to tailor ads you see on sites. By using this site you agree to our cookie policy). ACCEPT

Ask FinderBot

reCAPTCHA