Security is important to us at FMG, and while we do all we can to put the appropriate measures in place vulnerabilities are still possible so it's important to remain vigilant.
A security vulnerability is a weakness in a website, system or online service that could affect its security or expose information.
If you come across a vulnerability in one of the FMG websites listed below, please tell us so we can investigate and fix it. We welcome reports made promptly and in good faith.
This standard does not authorise security testing, scanning, hacking or attempts to gain access to FMG systems. Only parties engaged by FMG under a written agreement are authorised to carry out security testing.
How to report a vulnerability
To report a vulnerability, please email security@fmg.co.nz . We'll acknowledge your report within three working days.
You may submit a report without identifying yourself. However, we won't be able to provide updates unless you give us a way to contact you.
Don't include another personʼs personal information in your report.
This email address is only for reporting security vulnerabilities.
To report scams, phishing, or an issue with an account, standard or claim:
Report a scam, phishing or other issue
What to include
Please provide as much of the following information as you can without carrying out further investigation or testing:
- A short description of the vulnerability.
- How you came across it.
- The affected website, system, product, version or configuration.
- The steps needed to reproduce the issue, including any relevant proof of concept or screenshots.
- Whether the vulnerability has been shared with or published by anyone else.
- Whether any sensitive or personal information was exposed.
If you accessed information that was not yours, tell us all of the following:
- what information you accessed
- when you accessed it
- whether you have deleted any copies.
Sites where we'll investigate a vulnerability
- fmg.co.nz
- fmgconnect.co.nz
What not to report as vulnerability
The following are not to be reported as a vulnerability:
- Physical security testing, such as attempting to enter an FMG office or tailgating someone into a building.
- Social engineering, including phishing and whaling.
- User-interface or user-experience issues that don't create a security risk.
- Spelling or content errors.
- Network-level denial-of-service or distributed denial-of-service issues.
- Reports generated solely by automated scanning tools.
What you must not do
FMG will investigate the issue. You must not:
- access information that does not belong to you
- continue accessing a system after you have identified a possible vulnerability
- try to confirm the vulnerability or look for further examples
- copy, retain or share information that does not belong to you
- use another personʼs account, credentials or policy number
- submit false quotes, applications, claims, payments or policy changes
- carry out automated scanning or brute-force attempts; destroy, alter or corrupt data
- disrupt FMG systems or services, including through a denial-of-service or distributed denial-of-service attack
- install malware
- make publication of the vulnerability conditional on payment
- publish or share details of the vulnerability without FMGʼs written agreement
- share any personal information you accessed.
If you accidentally access information that is not yours, stop immediately. Don't copy or retain it. Delete any copies and tell us what you accessed and when.
What happens after you report a vulnerability
We'll:
- acknowledge your report within three working days
- review the information and, where necessary, work with the relevant service provider to validate the issue
- let you know the outcome of our investigation
- aim to address confirmed vulnerabilities as quickly as possible
- provide an update at least once every 30 days while the issue remains open
- tell you when the issue has been resolved.
The time needed to resolve a vulnerability may depend on third-party suppliers or contractual arrangements.
Third-party products and services
If the vulnerability affects a third-party product or service used by FMG, we may need to pass the relevant technical information to that provider so the issue can be investigated and resolved.
We won't share your name, contact details or other personal information with a third party without your permission, unless we are required to do so by law.
Privacy and confidentiality
Don't publish or share a vulnerability without FMGʼs written agreement. This helps prevent others from exploiting it while we investigate and resolve the issue. We'll work with you on the timing and resolution of the vulnerability.
Don't share any personal information you accessed through the vulnerability. Doing so could cause harm.
FMG will keep the information you provide confidential within FMG and our directly contracted suppliers, subject to any disclosure required by law.
FMGʼs commitment to you
If you come across a vulnerability in good faith, report it promptly and follow this standard, FMG won't initiate legal action against you in relation to the report.
This commitment does not apply to:
- deliberate or unauthorised security testing
- accessing or retaining information that does not belong to you
- actions that damage or disrupt FMG systems or services
- publishing or sharing information without FMGʼs agreement
- demands for payment in exchange for vulnerability details.
We'll communicate with you during our investigation and tell you when the issue has been resolved.
No rewards or payments
FMG does not operate a bug-bounty programme and does not offer rewards or payment for vulnerability reports.