Documentation

Responsible disclosure

How to tell us about a security weakness in our websites, API or data service, and what we ask of researchers.

Draft. This policy sets out how we intend to handle vulnerability reports. The reporting address, our response commitments and the legal safe-harbour wording are still to be confirmed, and the page will be reviewed by counsel before it takes effect.

Reporting a weakness

If you believe you have found a security weakness in a Crown Intelligence website, API or data service, please tell us privately so we can fix it before it is exploited.

To be provided: The mailbox for security reports (security@ is not in use today) and, if wanted, a PGP key or reporting form.

Please do

  • Report the weakness to us as soon as you can after finding it.
  • Give enough detail for us to reproduce it: the address or endpoint, the steps, the request and response, and the impact you expect.
  • Keep the weakness confidential until we have fixed it and agreed a disclosure date with you.
  • Use the minimum access needed to show the problem, and stop as soon as you have shown it.

Please do not

  • Exploit the weakness beyond what is needed to show it, or view, change or delete data that is not yours.
  • Run tests that degrade the service for others: denial of service, load tests, or high-volume automated scanning.
  • Use social engineering, phishing or physical attacks against our staff, premises or providers.
  • Test third-party services we use, or the official publishers whose data we collect.
  • Send spam or automated scanner output without a demonstrated, specific issue.

What is not a vulnerability here

  • The data is public: records, collections and bulk files are published on purpose, and reading them through the API is intended use.
  • The API is open today; the absence of an API key is a documented choice, not a flaw (see Authentication).
  • Reports about an official list's content belong with the publisher or our corrections process; see Corrections and de-listing.
To be provided: Other exclusions the owner wants to list (for example missing headers without a demonstrated impact, or our policy on framing pages).

What we will do

To be provided: Our commitments to reporters: how quickly we acknowledge a report and give an assessment, how we keep reporters informed, whether we credit them, and the legal safe-harbour statement for good-faith research. Not to be filled before counsel review.

Last updated 2026-10-03