This policy explains how members of the public can responsibly report vulnerabilities to the Department for Business, Innovation, Science and Trade (BIST).

It is intended for members of the public and external security researchers. Internal staff should instead report vulnerabilities directly to the Cyber Security team, and follow the internal Code Repository Hardening guidelines to minimise them.

If you believe you have found a security vulnerability, please submit a report via our HackerOne form.

Scope

• In scope: digital services operated by BIST, including repositories in the uktrade GitHub organisation
• Out of scope: denial of service, social engineering, physical attacks, and reports from automated scanners without a working proof of concept

Disclosure guidelines

• Do not share vulnerability details beyond BIST and the asset owner
• HackerOne accounts are optional, but allow you to receive updates on your report
• You must agree to HackerOne’s Terms, Privacy Policy, and Disclosure Guidelines
• BIST’s Cyber Security team assists with coordination, but the asset owner is responsible for remediation

Safe harbour

BIST will not seek prosecution of researchers who act in good faith: stay within the scope above, avoid destructive testing, and do not access, modify or retain other users’ data.

The BIST GitHub Security Policy is defined as a community health file, so every uktrade repository without its own SECURITY.md inherits it automatically. Do not add a SECURITY.md to your own repository — to suggest changes, raise a PR against the .github repository instead.