Safe reporting route
A responsible report should be submitted privately and should include the affected URL, description of the concern, evidence, browser or tool context, time observed and enough reproduction steps for safe investigation.
Do not access data
Reporters must not access, copy, alter, delete, download or disclose data. They must not attempt persistence, privilege escalation beyond a minimal proof of concept, social engineering, physical attacks, denial of service or public disclosure before review.
Good-faith handling
Good-faith reports that follow this policy can help improve security. This policy does not authorise testing, create a bug bounty, waive legal rights or guarantee payment.
Investigation and response
Reports should be triaged based on severity, reproducibility, affected systems and business impact. Where appropriate, fixes may be prioritised, monitored and documented.
Safe harbour limitation
Following this policy does not create automatic legal protection or permission to test. It explains how concerns should be reported safely. Any active testing, scanning, exploitation or access attempt requires written authorisation in advance.
Report quality
High-quality reports are factual, limited and reproducible. They avoid exaggeration, avoid data exposure, explain potential impact and include enough technical context for the issue to be investigated without causing harm.
Coordinated handling
Security issues should be handled privately until a fix or decision has been made. Public disclosure before responsible review can increase risk to systems, visitors and customers.