Vulnerability disclosure policy
If you think you've found a security problem in gpsites.co.uk or a practice website we host, please tell us.
How to report it
Email security@gpsites.co.uk with:
- what you found and where (the web address)
- how to reproduce it
- what an attacker could do with it
We’ll acknowledge your report within 3 working days and keep you updated until it’s fixed. We aim to fix high and critical problems within 14 days.
What we ask
- Only test against your own account, or against our demo practice at demo.gpsites.co.uk.
- Don’t access, change or delete anyone else’s data. Stop and tell us if you come across any.
- Don’t run denial of service tests or high-volume automated scans, and don’t try to trick practices or their staff.
- Give us reasonable time to fix the problem before telling anyone else.
If you follow this policy in good faith, we won’t take legal action against you, and we’ll thank you publicly if you’d like.
What this policy doesn’t cover
NHS services that practice websites link to, such as the NHS App or a practice’s online consultation tool. Please report problems with those to the organisation that runs them.