Security
Report a vulnerability
If you believe you have found a security issue in a CivicDirect property or product, we want to hear from you directly and quickly.
Where to send it
Email security@civic.direct. Please avoid filing security issues through general contact forms.
What to include
The affected property or product, a description of the issue, the steps required to reproduce it, and any impact you were able to demonstrate. Screenshots and request captures help.
What to expect
We aim to acknowledge reports promptly and to keep you informed while we investigate. We will not pursue legal action against researchers who report in good faith, avoid privacy violations and data destruction, and give us reasonable time to respond before public disclosure.
Please do not
Access, modify or delete data belonging to others; degrade service availability; or use social engineering against CivicDirect staff or the institutions we work with.