Report a vulnerability

What is in scope

This policy covers the public Our Elected Media hub and its source repository. The sibling Our Elected properties are separate sites with separate reporting scopes.

The hub is a frontend-only public site. It has no accounts, payments, database, uploads, admin area, client API, webhook, or scheduled job.

What to include

• The affected URL, file, or deployed version.
• Clear reproduction steps and the expected versus actual result.
• Security impact and any small, non-sensitive proof.

Please test safely

Do not access other people’s data, disrupt availability, send unsolicited messages, or copy credentials. Stop testing once you have enough evidence to explain the issue.

Our response

We aim to acknowledge reports within 48 hours. We will assess severity, keep the report private while a fix is prepared, and coordinate disclosure with you when appropriate. The mailbox’s delivery and monitoring are operational responsibilities and are still being verified.