Reporting route
Email security@hgv247.co.uk with the affected URL or component, the likely impact, clear reproduction steps and only the evidence needed to verify the issue. Our machine-readable disclosure details are published at /.well-known/security.txt.
Safe testing boundaries
Do not access another person's data, disrupt an emergency search, test third-party workshops, send spam, use social engineering or retain personal information. Stop as soon as you have enough evidence to describe the issue safely.
What happens next
We will acknowledge a credible report, assess severity and agree a communication route. This process is not a promise of a bounty or a legal safe harbour, but we will not pursue researchers who act in good faith within these boundaries.
What we already do
HGV247 runs behind Cloudflare with HTTPS everywhere, uses Turnstile on public forms, rate-limits abuse-prone endpoints, verifies Stripe and Outrank webhook signatures, hashes passwords with bcrypt, keeps an audit trail of administrative actions and isolates the application in its own hardened service and database schema. Details are in our privacy notice.
For ordinary account, listing or privacy matters, use the contact form instead.