WattleAddr
Sign inGet an API key
Security

Reporting a security issue

RR Sols Pty Ltd t/a WattleAddr · ABN 56 672 722 486 · Prepared 28 October 2026

If you think you have found a security problem in WattleAddr, please tell us. We read every report and we will not take legal action against you for research that follows the rules on this page.

How to report

Email security@wattleaddr.com.au. Please include what you found, the steps to reproduce it, the URLs or API endpoints involved, and what an attacker could do with it. Screenshots or a short proof of concept help. Do not include anyone else’s personal information in the report.

What is in scope

  • wattleaddr.com.au and www.wattleaddr.com.au
  • api.wattleaddr.com.au, using your own API keys
  • console.wattleaddr.com.au, using your own account and workspace
  • apps.wattleaddr.com.au, the backend of our Shopify app, using a store you own that has no real customers
  • The @wattleaddr/js and @wattleaddr/react packages on npm

Out of scope: WattleAddr Property (property.wattleaddr.com.au); WattleDB and anything under wattledb.com.au, including the database our services use; Shopify’s own platform (report those issues to Shopify); services run by our providers; findings that need a rooted or compromised device; missing headers or settings with no demonstrated impact; and reports from automated scanners that you have not confirmed by hand.

Rules for testing

  • Use only accounts, workspaces and keys you created. A free account is enough for almost everything.
  • Do not access, change or delete anyone else’s data. If you reach it by accident, stop, do not keep a copy, and tell us.
  • No denial-of-service or load testing, and no high-volume automated scanning. Stay within your plan’s rate limits.
  • No social engineering, phishing or physical attempts against our people or providers.
  • Do not use a vulnerability beyond what you need to show it exists.
  • Give us a reasonable time to fix the issue before you tell anyone else, normally 90 days from your report. We will agree a date with you.

Our promise to you

If you make a good-faith effort to follow these rules, we authorise your testing, we will not bring a civil claim against you for it, and we will not report it to police or any other authority. We cannot bind anyone else, such as our providers or a government agency. If someone else takes action over research that followed these rules, we will tell them we authorised it. This authorisation is the “prior written consent” our Terms of Service refer to for security testing. It covers only research that follows this page.

What happens next

  • We confirm we have your report within 5 business days.
  • We tell you whether we can reproduce it, and keep you updated until it is fixed.
  • When it is fixed, we tell you, and we will thank you by name on request.

We do not run a paid bug bounty. If a report shows that personal information was involved in an eligible data breach, we handle it under the Notifiable Data Breaches scheme as our Privacy Policy describes.