Security Contact & Disclosure

Suspected vulnerabilities can be reported through the contact form, marked for the attention of the security team. Please avoid including exploit detail in unencrypted correspondence.

A description of the issue, the affected URL or component, the steps required to reproduce it, and any observed impact.

Reports are acknowledged, triaged against severity and tracked to resolution. We will confirm when a fix has been deployed.

Access, modify or exfiltrate data belonging to other organisations, degrade service availability, or conduct social engineering against staff or customers.