Skip to content

Trust CentreVulnerability disclosure policy

Found a security issue? Tell us first.

We welcome reports from security researchers and customers. If you've found something that could put WiseBlock or the information in it at risk, report it privately and give us a fair chance to fix it before anyone else hears about it.

Email a report Back to the Trust Centre
  • Report toinfo@wiseblock.co.uk, subject "Security vulnerability report"
  • We aim toAcknowledge within 5 working days
  • Please don'tAccess other people's data, or disrupt the service

01How to report

What a useful report contains.

  1. What and where

    The page, address or endpoint affected, and the kind of issue you believe it is.

  2. How to reproduce it

    Step-by-step, with the requests and responses or screenshots that show it.

  3. What it could lead to

    What an attacker could do with it, as you understand it.

  4. How to reach you

    So we can ask questions and tell you when it's fixed.

02Scope and rules

Test carefully, and only what's yours to test.

In scope: wiseblock.co.uk and its subdomains, the WiseBlock back office, the resident and supplier portals, the WiseBlock mobile apps and the WiseBlock API.

Out of scope: services run by our suppliers (report those to them), and findings that need physical access to a device or a user's account details obtained without their permission.

  • Not allowed

    Denial-of-service or load testing; social engineering, phishing or physical attacks on our staff, customers or offices; spam; and anything that harms the service or other people's data.

  • Not allowed

    Accessing, changing or keeping data that isn't yours. If you reach someone else's information, stop, take only what proves the issue, and tell us.

  • Ask first

    Automated scanning at more than a gentle rate, and testing anything that sends messages or calls to real people.

03What you can expect

What we'll do in return.

  • Reply

    We aim to acknowledge your report within 5 working days, and keep you updated while we investigate.

  • Fix

    We'll work to fix confirmed issues promptly, and tell you when we have.

  • Credit

    With your agreement, we'll credit you for the find.

  • Good faith

    If you follow this policy, we won't pursue legal action against you for your research, and we'll treat your report as made in good faith.

We don't run a paid bug bounty. Please don't disclose an issue publicly until we've confirmed it's fixed.