---
title: Vulnerability Disclosure Policy
date: 2025-06-20T15:20:00+10:00
author: Walker Designs
canonical_url: "https://walkerdesigns.com.au/vulnerability-disclosure-policy"
section: Site Content
---
1. [ Home](https://walkerdesigns.com.au/)
2. Vulnerability Disclosure Policy
 
 

 

#  Vulnerability Disclosure Policy 

 

 

 

 

  At Walker Designs, the security of our infrastructure and the digital products we manage for our clients is a top priority. We welcome the contribution of independent security researchers and have created this policy to provide clear guidelines for conducting vulnerability discovery and reporting.

## Scope

Because we are a digital agency, determining what is in scope requires verifying that Walker Designs actively manages the asset.

**In Scope:**

- Our corporate websites and agency infrastructure: \*.walkerdesigns.com.com.au
- Custom plugins, themes, or applications developed and actively maintained by Walker Designs.

**Out of Scope (Do Not Test):**

- Client websites built by our agency but hosted and maintained by the client or a third party.
- Third-party SaaS platforms we utilize (e.g., Craft CMS Shopify, WordPress Core). Vulnerabilities in these platforms must be reported to the respective vendors.
- Any client infrastructure not explicitly managed by Walker Designs.

## **Report Vulnerabilities**

If you believe you've discovered a security vulnerability in a Walker Designs system, please notify us via <webmaster@walkerdesigns.com.au> and request a PGP public key.  
  
**What to include:**

- A description of the vulnerability and its potential impact.
- Clear, step-by-step instructions to reproduce the issue (or a proof-of-concept video/script).
- The specific URL, IP address, or asset where the vulnerability exists.

## Expected Response Timelines

- **Acknowledgment:** Within \[3\] business days.
- **Triage &amp; Validation:** Within \[7\] business days.
- **Remediation:** We aim to patch critical vulnerabilities within \[14\] days and standard vulnerabilities within \[45\] days, subject to client approval and deployment schedules.

Walker Designs does not currently operate a paid bug bounty program. We do not offer financial compensation for vulnerability reports. However, for reports that lead to a critical remediation, we are happy to provide a letter of recommendation or acknowledgment in our Security Hall of Fame (with the researcher's permission).