Security Disclosure

We welcome good-faith security research on this public website. If you believe you have found a vulnerability, we want to hear about it through the route described below, and we will treat your report with care.

This disclosure route covers this public marketing website only.

• –In scope — the public pages, forms and client-side behaviour of this website.
• –Out of scope — customer systems, programme data, operational environments and any third-party services. Do not test these under any circumstances.

Report via the Contact form, marking the description “SECURITY DISCLOSURE” so it is routed correctly. Please include reproduction steps and contact details so we can follow up.

Do not include classified, export-controlled or third-party confidential data in your report.

Good-faith, non-destructive research within the scope above will not be treated as unauthorised access. In return, we ask that you:

• –do not perform denial-of-service testing;
• –do not exfiltrate data or access data that is not yours;
• –do not use social engineering against staff or partners;
• –give us reasonable time to respond before any public disclosure.

We aim to acknowledge reports promptly and to triage them in a reasonable timeframe. Response times vary with the nature and severity of the issue; we will keep you informed through the contact details you provide.

We do not operate a formal recognition programme or hall of fame. With your consent, we may thank you for your report — and we are genuinely grateful to researchers who help keep this website secure.