Vulnerability Disclosure Policy

Purpose and Scope

SWGfL (Southwest Grid for Learning Trust) is committed to protecting the security of the children, young people, schools, and organisations we serve. As part of that commitment, we recognise that independent security researchers may occasionally identify vulnerabilities in our systems and services.

This Vulnerability Disclosure Policy (VDP) establishes a clear, ethical, and legally compliant framework for reporting such vulnerabilities. It defines what we expect from researchers, what researchers can expect from us, and the boundaries within which responsible research may be conducted.

This policy is published in accordance with guidance issued by the National Cyber Security Centre (NCSC) and aligns with RFC 9116 (the security.txt standard).

What This Policy Covers

This policy applies to vulnerabilities identified in:

• SWGfL-owned and operated web properties (swgfl.org.uk and associated subdomains)
• SWGfL digital services and platforms provided to schools and partner organisations
• SWGfL email infrastructure and domain configuration
• Publicly accessible APIs operated by SWGfL

What This Policy Does Not Cover

The following are explicitly out of scope:

• Third-party services or platforms that SWGfL uses but does not operate
• Physical security of SWGfL premises
• Social engineering, phishing, or vishing attacks against SWGfL staff
• Denial of service (DoS/DDoS) testing of any kind
• Vulnerabilities in systems operated by schools or partner organisations using SWGfL services

SWGfL does not operate a bug bounty programme. We are unable to offer financial compensation, rewards, or gifts in return for vulnerability reports, regardless of the severity of the finding

Table of Contents

1. Our Commitments to Researchers
2. Researcher Responsibilities
3. How to Submit a Report
4. Legal Framework
5. Unsolicited and Out-of-Scope Reports
6. Policy Governance

Researcher Responsibilities

Permitted Activities

To qualify for safe harbour under this policy, researchers must:

• Report findings promptly via the designated channel (security@swgfl.org.uk)
• Provide sufficient detail for SWGfL to reproduce and verify the vulnerability
• Allow SWGfL a reasonable remediation period (minimum 90 days) before any public disclosure
• Make every effort to avoid accessing, modifying, or deleting data belonging to SWGfL or its users
• Test only against systems you are authorised to access

Prohibited Activities

The following actions are strictly prohibited and will not be covered by safe harbour provisions:

• Accessing, copying, modifying, or exfiltrating any data — including personal data relating to children or young people
• Sending forged, spoofed, or unauthorised emails purporting to originate from SWGfL domains
• Conducting automated scanning or enumeration of SWGfL infrastructure without prior written consent
• Exploiting a vulnerability beyond what is necessary to demonstrate its existence
• Disclosing vulnerability details to third parties before SWGfL has had the opportunity to remediate
• Any activity that could impact the availability or integrity of SWGfL services
• Contacting SWGfL staff individually, or via channels other than security@swgfl.org.uk, regarding vulnerability reports

Given the nature of SWGfL’s work with children and young people, we apply a particularly high standard to data protection. Any report involving unauthorised access to personal data will be treated with utmost seriousness and may be referred to the Information Commissioner’s Office (ICO) and relevant authorities

Legal Framework

This policy is intended to provide clarity and protection for good-faith security research. However, it does not grant blanket authorisation to conduct security testing of SWGfL systems.

Researchers must be aware of and comply with all applicable laws, including:

• Computer Misuse Act 1990 (UK)
• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Network and Information Systems (NIS) Regulations 2018

Safe harbour under this policy applies only where the researcher has acted in good faith, within the defined scope, and in compliance with all terms set out herein. SWGfL reserves the right to take legal action where activity falls outside the bounds of this policy, particularly where the safety of children or the integrity of personal data is at risk.

Policy Governance

Policy Owner

Head of Technology, SWGfL

Review Frequency

Annually, or following a material security incident

Next Review Date

May 2027

Version

1.0

Publication Date

June 2026

Aligns With

NCSC Vulnerability Disclosure Toolkit; RFC 9116