Responsible Disclosure

Data Bureau (Singapore) takes the security of its systems and public registry seriously. If you have identified a potential security vulnerability in any Data Bureau system, website, or public-facing infrastructure, we encourage responsible disclosure.

To report a vulnerability, send a detailed description to security@databureau.com.sg. Include a description of the vulnerability, the steps required to reproduce it, the potential impact, and any supporting evidence. Do not publish or share details of the vulnerability with any third party before Data Bureau has had a reasonable opportunity to investigate and remediate.

Data Bureau will acknowledge receipt of a responsible disclosure report within 3 business days and will provide a status update within 14 business days. Data Bureau does not operate a bug bounty programme. Responsible disclosures made in good faith will not be subject to legal action.

This policy applies to databureau.com.sg and all Data Bureau-operated digital systems. It does not apply to third-party services or platforms that Data Bureau uses but does not operate.