Security

This service holds information about children — names, schools, towns, photographs and video. If you have found a way to reach any of it that you should not be able to, we want to hear from you before anybody else does.

Reporting something

Email [email protected]. Include enough for us to reproduce it — a URL, the steps, and what you were able to see. You do not need to write a formal report and you do not need to prove impact; a rough description of something that looks wrong is genuinely more useful to us than silence.

We will acknowledge within a few days, and the reply comes from someone who can fix it rather than from a triage system.

What we ask

Please do not access, download, modify or keep any data belonging to a family beyond the minimum needed to demonstrate the problem — and tell us what you did see, so we know what was exposed. Please do not run tests that degrade the service for families using it, and please give us a reasonable chance to fix it before publishing.

If you report something in good faith and follow the above, we will not pursue you for it. We would rather know.

What we do not offer

There is no bug bounty and no payment. Saying so plainly seems better than implying a reward that does not exist. Credit on this page, if you want it, is something we can do.

Things we already know

Reports about missing security headers, mail-server configuration, or automated-scanner output with no demonstrated impact are usually not something we can act on. Anything that reaches another family’s data, any authentication bypass, and anything that lets a page about a child be edited or published by somebody who should not be able to, we will treat as urgent.