generated: '2026-07-27'
method: searched
probe: true
policy:
- https://www.essentialenergy.com.au/about-us/corporate-governance/vulnerability-disclosure-policy
contact: []
contact_note: >-
  The published policy directs finders to email a security address. The address itself was
  NOT captured verbatim: www.essentialenergy.com.au returns HTTP 403 to every automated
  client (Cloudflare bot management), and the search index rendering of the page redacts
  the mailbox. It is deliberately left empty here rather than guessed.
model: responsible-disclosure
bug_bounty: false
bug_bounty_note: >-
  No HackerOne, Bugcrowd or Intigriti programme was found for Essential Energy. The policy
  is a coordinated-disclosure policy without a bounty.
policy_terms_reported:
- >-
  Operates under a responsible disclosure model: finders are asked not to disclose a
  vulnerability publicly until Essential Energy has had time to remediate it.
- >-
  Finders are asked to email enough information for Essential Energy to locate or
  replicate the vulnerability.
- >-
  The policy explicitly does NOT authorise any individual, group or company to conduct
  hacking or penetration testing against Essential Energy systems.
terms_caveat: >-
  These three points are reported from the search-engine rendering of the policy page, not
  from a direct fetch. The page URL was confirmed to exist and be titled "Vulnerability
  Disclosure Policy" under /about-us/corporate-governance/; the page body itself is
  unreachable to automated clients. Treat the wording as a summary, not a quotation.
security_txt:
  present: false
  probes:
  - url: https://www.essentialenergy.com.au/.well-known/security.txt
    status: 403
    note: Cloudflare bot management returns 403 to every path on this host, including 404s.
  - url: https://dapr.essentialenergy.com.au/.well-known/security.txt
    status: 404
  - url: https://engage.essentialenergy.com.au/.well-known/security.txt
    status: 404
  - url: https://essentialenergy.maps.arcgis.com/.well-known/security.txt
    status: 404
  gap: >-
    A published HTML disclosure policy with no RFC 9116 security.txt is the classic
    machine-unreadable disclosure gap. Adding /.well-known/security.txt with Policy: and
    Contact: lines would make an existing, real programme discoverable to automation.
scope_note: >-
  The disclosure policy is a corporate-wide policy covering Essential Energy systems. It
  is not scoped to, and does not mention, the public ArcGIS data surface — which is hosted
  on Esri ArcGIS Online, where platform vulnerabilities would be reported to Esri
  (security@esri.com / trust.arcgis.com) rather than to Essential Energy.
evidence:
- source: https://www.essentialenergy.com.au/about-us/corporate-governance/vulnerability-disclosure-policy
  kind: disclosure-policy-page
  http_status: 403
  discovered_via: search index (page title "Vulnerability Disclosure Policy", 2026-07-27)
- source: https://www.essentialenergy.com.au/about-us/corporate-governance/policies
  kind: corporate-governance-policy-index
  http_status: 403
supersedes: >-
  The 2026-07-27 first-round review recorded no disclosure programme because every probe
  against www.essentialenergy.com.au was Cloudflare-blocked. The programme exists; the
  probe was blind.