Responsible disclosure

We welcome reports from anyone who finds a security weakness in Inclusion Studio. Telling us privately gives us the chance to fix the problem before anyone is harmed. This policy follows the approach in the National Cyber Security Centre’s Vulnerability Disclosure Toolkit.

What is in scope?

Inclusion Studio is pre-pilot. There is no live application holding real learner data. In scope today:

• this website and the pages and files it serves;
• any Inclusion Studio prototype or preview we have shared publicly;
• any code or configuration we have published.

Out of scope:

• services run by other companies, such as our hosting, database or sign-in providers. Please report those to the provider under its own disclosure policy;
• social engineering of our staff or pilot contacts;
• physical attacks, and denial-of-service or load testing;
• reports from automated scanners with no demonstrated impact.

When the application moves towards a pilot, we will update this page to say which environments may be tested and how.

How do I report a vulnerability?

Use our contact page and put “Security” at the start of your subject line. Please include:

• what you found and where (the URL, file or component);
• the steps to reproduce it;
• what an attacker could do with it, as you understand it;
• any proof-of-concept, kept to the minimum needed;
• how you would like to be credited, if at all.

Please do not include real personal data in your report. If you came across any, describe it rather than copying it.

What do we ask of you?

To stay within this policy, please:

• act in good faith and avoid harm to people, data and services;
• test only against systems in scope, and stop as soon as you have confirmed the issue;
• never access, change, download or keep other people’s data. If you accidentally see personal data, stop, tell us, and delete anything you hold;
• not disrupt services, for example by load testing or flooding forms or inboxes;
• give us reasonable time to fix the issue before telling anyone else, and agree a disclosure date with us.

How will we respond?

We aim to:

• acknowledge your report within 5 working days;
• tell you whether we have confirmed the issue and how we plan to fix it;
• keep you updated until it is resolved;
• credit you publicly once it is fixed, if you would like that.

We are a small team at an early stage, so these are targets rather than guarantees. If a report affects one of our providers, we may share the technical details with them so they can fix it, and we will tell you if we do.

What is our safe harbour commitment?

If you make a good-faith effort to follow this policy, we will consider your research authorised. We will not take legal action against you or report you to law enforcement for it. If someone else brings a claim relating to research that followed this policy, we will make it known that your actions were authorised by us.

This commitment covers only Inclusion Studio’s own systems and only our own decisions. We cannot authorise testing of other companies’ services, and we cannot set aside the law. In the UK the Computer Misuse Act 1990 still applies. If you are unsure whether something is allowed, ask us first.

Do you pay a bug bounty?

No. We do not run a bug bounty programme and cannot offer payment for reports. We are grateful for every responsible report and will credit you if you wish.

Where can I learn more about our security?

See our security page for how the product is designed and what has and has not been tested, and the assurance roadmap for the independent checks we will complete before real learner data is used.