RESPONSIBLE DISCLOSURE
Bug Bounty
Help us keep this website safe. If you discover a security vulnerability, please report it privately so we can investigate and fix it.
Report a vulnerability
Use the subject “Security vulnerability report”. Include the affected URL, a clear description of the issue and its impact, minimal steps to reproduce it, your suggested CVSS v3.1 score and vector, and a way to contact you. Redact personal information, credentials and tokens from supporting evidence.
Reports and reporter details will be handled confidentially, shared only with those who need them to investigate or remediate the issue, or where required by law. We will not name you publicly without your permission. Do not email sensitive personal data or live credentials; ask us to agree a secure transfer method first.
Keep testing safe and in scope
This programme covers vulnerabilities in this website on its current public hostname. Other domains, third-party platforms, hosting infrastructure and external services are excluded unless we give written permission. A flaw in our own configuration of an integrated service may be eligible if its impact is on this website.
Use only accounts and data you own or have explicit permission to test. Keep requests low-volume and stop once you have enough evidence. Do not access, copy, alter or delete other people’s data; disrupt availability; perform denial-of-service tests; use social engineering; or install malware or persistence. If you encounter personal data, stop immediately and report it without retaining copies.
Please report promptly and keep findings private while we investigate. Agree a coordinated publication date with us before sharing technical details. If you are unsure whether a test is permitted, contact us before proceeding. This policy does not authorise access to third-party systems.
Small rewards. Meaningful thanks.
For eligible, verified reports, we offer the following rewards in GBP, based on CVSS v3.1 and the demonstrated impact on this website.
Critical · CVSS 9.0–10.0
£450
High · CVSS 7.0–8.9
£250
Medium · CVSS 4.0–6.9
Low · CVSS 0.1–3.9
£25
Informational · CVSS 0.0
No monetary reward
Rewards apply to the first complete report of a previously unknown, reproducible, in-scope vulnerability with real security impact. Duplicate reports and multiple symptoms of the same root cause receive one reward. Automated scan results alone, theoretical issues, cosmetic bugs and missing best-practice headers without demonstrated impact are not eligible.
We validate severity and eligibility using the evidence supplied; a claimed CVSS score does not automatically determine a reward. Payment is subject to validation, compliance with this policy and applicable law. We will confirm the assessment and payment arrangements with you. Requests for payment must not be used to threaten disclosure or disruption.
What happens next
We aim to acknowledge reports within five working days, investigate their impact and keep you informed of progress. Resolution times depend on severity and complexity, so we cannot promise a fixed repair deadline. Critical issues are prioritised.
Thank you for helping us protect visitors and improve the security of this website.