Skip to main content

Security

REPORT AVULNERABILITY.

If you have found a security issue in Backed, we want to hear about it. This is how to tell us, what we ask of you, and what you can expect from us.

Last reviewed 22 October 2026

How to report

Email security@backed.giving with what you found, the steps to reproduce it and the address or account it affects. Please do not include other people’s personal information. Machine-readable contact details are at /.well-known/security.txt.

Scope

In scope:

  • backed.giving and every subdomain of it, including each Organisation’s own portal host
  • the Backed API (api.backed.giving)

Out of scope:

  • denial of service, load or volume testing
  • social engineering of Backed staff, customers or applicants, and physical attacks
  • the services of third-party providers (report those to the provider)
  • reading, changing or deleting data that is not your own beyond what you need to show the issue

Safe harbour

If you act in good faith, stay within the scope above, avoid harm to people and data, and give us a reasonable time to fix an issue before you disclose it, we will not pursue or support legal action against you for your research, and we will work with you to understand and resolve the issue quickly.

Our response

We acknowledge a report within 2 business days and triage it within 5 business days, then keep you told until it is resolved. We do not run a paid bounty programme.

How we protect data, and where it is kept, is on the trust page.