TabledHQ
Sign inStart free

Reporting a security problem

If you think you have found a security weakness in TabledHQ, we want to hear about it. This page explains how to tell us and what happens next. Last updated 3 November 2026.

Security contact

Email security@tabledhq.co.uk. Our machine-readable details are in security.txt.

What to report

Anything that could put our users, their data or the service at risk, for example:

  • getting into an account or data that isn't yours;
  • cross-site scripting, request forgery or injection;
  • ways round sign-in, payment or plan limits;
  • personal data exposed where it shouldn't be.

For a bug that isn't a security issue, or a mistake in the information we show, please use the help pages instead.

How to report

  • Describe the problem, where you found it and the steps to see it again.
  • Tell us what an attacker could do with it, if you know.
  • Leave out other people's personal data, passwords and card details.
  • Give us a reasonable chance to fix it before you tell anyone else.

What we promise

  • We will acknowledge your report within 5 working days.
  • We will look into it, keep you updated and tell you when it is fixed.
  • We will treat your report and details in confidence and not share them without your agreement.
  • If you would like, we will thank you by name once the problem is fixed.

We don't currently run a paid bug bounty.

Safe harbour

If you act in good faith, follow this policy and stop as soon as you have found a problem, we will not take legal action against you or report you to the police for your research. Good faith means you:

  • only test against your own account, or accounts you have permission to use;
  • don't view, change, keep or delete other people's data beyond the minimum needed to show the problem;
  • don't disrupt the service or degrade it for others;
  • don't ask for payment in return for the details.

This can't bind third parties such as our hosting or payment providers, and it doesn't cover breaking the law.

Out of scope

  • denial of service, load or volume testing, and spam;
  • social engineering or phishing of our staff or users, and physical attacks;
  • reports from automated scanners with no shown impact;
  • missing best-practice headers or settings with no shown impact;
  • problems in third-party services we use (report those to the provider), and the official data sources we link to.