Security policy.
This policy covers www.308.dev and the information people send us through it. It explains how we protect both, what we ask of you, and how to report a problem.
Version 2.0. Effective 27 October 2026.
How we protect this website
Every connection to the site is encrypted, and browsers are told to refuse unencrypted connections to it. The site tells browsers not to load it inside another site’s frame, not to guess at file types, and not to give it access to your camera, microphone or location.
Administrative access to the site and the systems behind it needs multi-factor authentication. We review and patch the software the site depends on as part of normal work.
Information you send us
What you submit through the contact form or the defence request goes into our own records system and is only seen by the people who need to answer it. We don’t sell it and we don’t use it for advertising.
Please don’t send anything sensitive through the form. If a conversation needs it, we’ll move to an encrypted channel, and we put a non-disclosure agreement in place before anything confidential is shared in either direction.
Suppliers
Suppliers who handle our information are assessed before we use them, and their access is limited to what the work needs.
What we don’t publish
We don’t list the specific controls, frameworks or tools we run, because that list is more useful to an attacker than to anyone else. Clients and partners can review them under a non-disclosure agreement.
Reporting a vulnerability
If you find a security problem with this site or anything of ours, tell us through the contact form and choose “Security report”, or message us on Signal. Include what you found and how to reproduce it.
We’ll acknowledge your report, keep you updated while we fix it, and credit you if you’d like to be credited. Please give us a reasonable chance to fix the problem before you tell anyone else, and don’t access more data than you need to show the problem exists.
We won’t take action against anyone who reports a problem in good faith and follows this policy.
If something goes wrong
If an incident affects personal information we hold, we’ll tell the people affected and the Office of the Australian Information Commissioner where the Privacy Act 1988 requires it.
308, Level 1, 63-73 Ann Street, Surry Hills NSW 2010, Australia. Phone 1300 711 380.