Security and Responsible Disclosure, WAJD Academy

Reporting a problem

If you believe you have found a security weakness in WAJD Academy or any WAJD service, please tell us. Write one email describing what you found, the exact address or request involved, and the steps to reproduce it.

security@wajd.co.uk

Please put the details in the body of the email as plain text. We do not open attachments, archives, or links to reports hosted on file sharing sites, so a report sent that way cannot be read or acted on.

WAJD is used by children. Please test only against accounts you created yourself. Do not view, change, or download data belonging to anyone else, and do not run load, denial of service, or spam tests. A test that interrupts a lesson in progress affects a child's learning, so we ask you to stop as soon as you have proof a weakness exists rather than exploring how far it goes.

What we do with a report

We aim to acknowledge a genuine report within five working days.
We assess it, fix what needs fixing, and tell you when the fix is live.
Where the law requires it, we notify the Information Commissioner's Office and anyone affected.
We are glad to credit you by name once the issue is resolved, if you would like that.

Scope

This policy covers wajd.co.uk and every wajd.co.uk subdomain. It does not cover services run by other companies that we link to, such as exam board websites or our payment provider. Report issues in those to their owners.

Findings that come from an automated scanner with no demonstrated impact are not usually treated as security issues on their own. That includes missing headers on pages with no user data, version numbers reported by fingerprinting tools, and configuration advice with no route to exploit it.

Rewards

WAJD is free to use and is funded to keep it that way. We do not operate a paid bug bounty. There is no reward, fee, invoice, retainer, or consultancy engagement attached to a report. Credit and our thanks are what we offer, and we offer them sincerely.

A note on unsolicited offers. We regularly receive cold emails claiming to have found problems with our site, offering to share a report or arrange a call, and asking whether we pay a bounty. These messages are almost always mass sent, contain no actual finding, and are a route to a paid engagement or to getting someone at WAJD to open a file. We do not reply to them, we do not accept files or links from them, and we do not book calls from them. If you have a real finding, the email address above is the way to reach us, and a specific reproducible description is what tells us your report is genuine.

How we check our own security

We run an automated review of every WAJD domain covering transport security, browser protection headers, certificate health, and the domain records that stop someone sending email in our name. We act on what it finds rather than waiting to be told.