Reporting a security problem

Recount handles other people’s accounting records and mailboxes. If you have found a way to reach data or functions you should not be able to reach, we want to hear about it, and we will not take action against you for telling us.

What we do in return

• We acknowledge your report within 3 business days (Australian Eastern time).
• We tell you our assessment — whether we can reproduce it, how serious we think it is, and what we plan to do — within 10 business days.
• We keep you updated at least every 10 business days until it is closed, and we tell you when the fix is live.
• We will credit you by name when the fix ships, if you would like that. We do not currently pay bounties.

Safe harbour

If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research, and we will treat your report as an authorised test rather than an attack. If a third party brings action against you for work that followed this policy, we will say publicly that it was authorised.

In scope

• app.recount.au — the Recount application
• api.recount.au — the Recount API
• recount.au — this site

Anything else is out of scope, including the services we connect to on a customer’s behalf (Xero, Microsoft, Google) and the platforms we run on. Report problems in those to their own security teams; if the problem is in how we use them, that is in scope and we want it.

Rules we ask you to follow

• Use your own account and your own data. Do not access, modify or delete anyone else’s records, emails or documents. If a flaw exposes someone else’s data, stop at the point where you have proved access, and tell us what you saw rather than collecting it.
• Do not degrade the service. No denial-of-service, load or volumetric testing, no spam, and no automated scanning heavy enough to affect other people’s use.
• No social engineering of our staff, customers or suppliers, and no physical testing.
• Give us 90 days before publishing, or less if we agree. We will not ask for indefinite silence.

Usually not accepted

Reports that describe only a missing or misconfigured header, an email policy record, a rate limit, TLS configuration, a version banner, or raw scanner output, with no demonstrated impact, will usually be closed without a fix. If you can show the impact, send it anyway.

If you have found customer data

Tell us immediately and do not download, copy, or keep it. We are an Australian business and a serious exposure may be notifiable under the Privacy Act, so the clock starts when we learn about it. Your report is what starts it.

This policy covers the Recount service. Machine-readable version: /.well-known/security.txt. Last updated 23 September 2026.

← Back to recount.au