Security & Vulnerability Disclosure
Security is treated as part of the engineering lifecycle of this website and its associated systems. If you discover a suspected vulnerability, please report it responsibly rather than exploiting it beyond what is reasonably necessary to demonstrate the issue.
What to report
Report issues that could affect confidentiality, integrity, availability, authentication, authorisation, personal-data handling, or the secure operation of the site.
Responsible testing
- Test only systems you are authorised to test.
- Avoid accessing, changing, deleting, or downloading data that does not belong to you.
- Do not perform denial-of-service, destructive, social-engineering, credential-stuffing, or other disruptive testing.
- Stop testing once you have enough evidence to explain the issue.
Report
Use the contact page to report a vulnerability. Include the affected URL or component, a concise description, reproduction steps, impact, and any relevant logs or screenshots that do not expose unnecessary personal information.
Response
Reports will be reviewed as practical. A report may require additional information before the issue can be assessed. This page does not create a bug-bounty program, guaranteed response time, or promise of compensation.
Third-party systems
Issues in external providers should be reported to the relevant provider as well as, where useful, to the site owner if the issue affects this website's security posture.