Responsible disclosure

If you’ve found a security issue with our website or systems, we’d genuinely like to know before anyone else does.

How to report

Email details of the issue, including steps to reproduce it, to [email protected]. Please don’t publicly disclose an issue until we’ve had a reasonable chance to fix it.

What we ask

Please don’t access, modify, or delete data that isn’t yours while testing, and don’t run automated scanners against our production systems without checking with us first.

What you can expect

We’ll acknowledge your report within two working days and keep you updated as we investigate and fix confirmed issues.