Report a security problem

If you think you have found a weakness in this website, a way to see data you should not, to sign in as somebody else, or to change something you should not be able to change, we want to hear about it. People trust us with their CVs and their details, and a report from you protects them.

1. How to tell us

Email dpo@hiringuk.co.uk with the word Security in the subject. Tell us the page, what you did, what happened, and how we can see it for ourselves. Screenshots help. The same address is published in our security.txt file, the standard place security researchers look.

Please do not put a CV, a password or anybody's personal details in the email. If you saw somebody else's data by accident, tell us that you saw it, not what it said.

2. What we promise

• We reply within three working days to say we have it.
• We look into every report and tell you what we found and what we fixed.
• If personal data was at risk we follow our breach process in the privacy notice, including telling the Information Commissioner's Office within 72 hours where the law requires it.
• We will not take legal action against anybody who reports in good faith and follows the rules below.
• We name you as the finder if you would like that, and keep you anonymous if you would not.

We are a small UK company and do not run a paid bug bounty. We say so now rather than disappoint you later.

3. Please do not

• Look at, copy, change or delete data that is not yours beyond the minimum needed to show the problem.
• Slow the site down or knock it over: no flooding, no automated scanning at volume, no denial of service.
• Send spam, try to trick our users or staff, or test anything by post, phone or in person.
• Tell anybody else about the problem before we have fixed it, or before 90 days have passed, whichever comes first.

4. Not a security problem?

If somebody has pretended to be us or an employer has asked you for money, see staying safe. To report wrongdoing at work, see speaking up. For anything else about your data, see the privacy notice or contact us.