How to report it
Email [email protected] with what you found, where it is, and the steps to reproduce it. Screenshots or a short proof of concept help a lot.
If the details are sensitive, say so in your first email and leave them out. We’ll sort out a safer way for you to send them.
What happens next
We’ll reply to let you know we’ve got your report, look into it, and keep you posted while we fix it. If you’d like to be credited once it’s fixed, tell us how you want to be named.
Please don’t
- access, change or delete data that isn’t yours
- run denial-of-service tests, or anything that could take a site down
- send phishing emails to us or our clients, or try to trick our staff
- tell anyone else about the problem before we’ve had a fair chance to fix it
The bugs on our homepage are the harmless kind. You don’t need to report those.
Our machine-readable contact details are in security.txt.