Security Contact

Found a vulnerability? Please report it responsibly.

Report security issues to support@nrapps.co.uk. This is a small, personally-maintained system (built and run by Oliver Viney) rather than a large security team — please allow a few days for a response, and follow up if you don't hear back.

What to include

Steps to reproduce the issue, as precisely as you can.
The affected URL or feature.
What you'd expect to happen, and what actually happens.
Your assessment of the impact, if relevant (e.g. what data or access it could expose).

Responsible disclosure

Report privately first, and give a reasonable amount of time to fix the issue before any public disclosure.
Avoid accessing, modifying, or deleting data beyond what's needed to demonstrate the issue — a description or a screenshot is usually enough.
Don't run automated scanners or load tests against the live system without checking first — this runs on a small VPS and heavy traffic can affect real users.
Don't use a vulnerability to access other users' assessments, accounts, or personal data.

Good faith research

Security testing carried out in good faith, in line with the guidelines above, won't be treated as unauthorised or malicious. If in doubt about whether something is in scope, ask first at support@nrapps.co.uk.

What's already in place

For context, this system already applies: bcrypt-hashed passwords, signed httpOnly/secure session cookies, server-side role checks on every request (not just hidden UI), a login lockout after repeated failed attempts, TLS via Let's Encrypt, and standard security response headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy). Reports that build on or work around these are exactly what this page is for.