Reporting a security issue

We welcome reports from security researchers and customers. If you believe you have found a vulnerability in BMS Pro Trade, please tell us before disclosing it publicly.

How to report

Email security@bmspros.com.au. Include the affected URL or endpoint, the steps to reproduce, and what you were able to access. Screenshots or a short recording help.

What to expect

We aim to acknowledge reports within five business days and will keep you updated while we investigate. We do not currently run a paid bounty programme.

Testing guidelines

Please test only against accounts and data you own. Do not run denial-of-service or load tests, do not access, modify, or retain other customers’ data, and stop as soon as you have enough to demonstrate the issue. We will not pursue action against researchers who follow these guidelines and report in good faith.

Machine-readable contact

The same details are published at /.well-known/security.txt.