What to include
Give the affected public URL, a short description and enough non-sensitive information to understand the concern. Use fictional examples and redact screenshots. Do not actively test a security issue in a way that could affect other people or the service.
How messages are handled
Messages are used to handle the report. Unnecessary student information received accidentally will be removed promptly where practicable. Resolved site-related correspondence is normally deleted within 12 months of resolution unless needed for an ongoing issue or a legal requirement. See the Privacy Policy.