Start with a short description
Email info@stratfordconsulting.co.uk with “Security disclosure” in the subject. Include the affected URL, a description of the behaviour and a safe way to contact you.
Do not include live credentials, personal records or confidential customer data. We can agree a suitable route for sensitive technical evidence after initial contact.
Keep testing proportionate
Please avoid disruption, accessing other people’s data, social engineering and denial-of-service activity. If you encounter personal information, stop testing and describe what happened without copying the data.
Coordinate disclosure
Allow us to assess the report and coordinate remediation before public disclosure. An initial report does not grant permission to access systems or customer accounts.