Report concerns responsibly.

How to report

Use the contact form with “Website security report” selected. Describe the affected URL, what you observed, safe reproduction steps and the potential impact. Do not include credentials or unrelated personal data.

Please avoid

• Accessing, changing, downloading or deleting data that is not yours.
• Disrupting availability, sending high-volume traffic or testing third parties.
• Social engineering, phishing, physical intrusion or privacy violations.
• Publishing details before there has been a reasonable opportunity to investigate and mitigate.

What you can expect

Good-faith reports are acknowledged within five working days and handled discreetly. For validated issues I will confirm receipt, keep you informed of remediation progress at reasonable intervals, and let you know when the matter is resolved. This page is not a bug-bounty programme and does not promise payment.

Safe harbour: research carried out in good faith and in line with this guidance will not be pursued or reported as a violation. If you are unsure whether a specific action is authorised, please ask first via the contact form before proceeding.

Security contact file

Automated tools can also find the standard security.txt file.