Responsible disclosure

Improving the security of our systems is an ongoing process. If you discover a bug or security vulnerability in our systems, we would greatly appreciate if you could let us know. We will then work to fix the issue as quickly as possible. We ask that you wait to share details of the bug or make it public until we have had the chance to address it. Depending on the nature and severity of the issue, this typically takes a few days. If a vulnerability is disclosed before we have had a chance to fix it, there’s a risk that other users’ security could be compromised.

Once we have received the bug, we will work to resolve it, notify the Cyber Security Centre, and inform the affected users. Only once this has been done is it safe to publicly disclose the issue, as the security of the affected users will then no longer be at risk. 

Responsible bug testing

Certain types of bug testing may be classified as hacking, which can be illegal under criminal law. This is beyond OnlineFundraising’s control. However, we guarantee that OnlineFundraising will not report you to the authorities if you contact us with information about a security vulnerability. In such cases, we will do everything we can to collaborate with you to resolve the issue.

While the process is underway, it is important that you avoid any actions that could infringe upon others’ rights, as we can’t control whether others choose to take further action. If the situation escalates into a criminal case, we may be required to disclose your identity to the authorities. If you are unsure whether your actions may have gone too far, we encourage you to contact us anonymously. However, please keep in mind that it is important for us to be able to reach you should we need further details regarding the security vulnerability.

We also encourage responsible behaviour in this area, which includes, but is not limited to, not sharing confidential data with others, notifying OnlineFundraising if you gain access to others’ data or the ability to delete or modify it, and avoiding actions like DDoS attacks, as these could affect other users. 

Contact us