Vulnerability disclosure

This is the security policy for findaproduct.co.uk. It is not the privacy notice.

If you find a vulnerability, email hello@findaproduct.co.uk with the subject line “Security”. Describe the issue, the URL, and a way we can reproduce it. Do not include payment-card numbers or passwords.

Please give us a reasonable time to investigate before you publish details. We will not ask you to stay silent about a problem we refuse to fix. We do not run a paid bug-bounty programme.

Out of scope: social-engineering our email, denial-of-service tests, and reports from automated scanners that do not show a concrete impact.