Skip to content

Home Improvement Leads / Legal / Security and reporting a problem

Security and reporting a problem

What we do, and how to tell us if you spot something.

DRAFT. This text is a starting point and has not been checked by a solicitor. Replace the square-bracket items and have it reviewed before the site goes live.

How we protect data

  • Staff sign-in to the internal tools needs a password and a two-step code, and there are only two staff accounts.
  • Customers sign in with a one-time link or code sent to their email; there is no password to steal.
  • The database lets the public read published articles only. A signed-in customer can see only the leads sent to their own account. These rules are enforced by the database itself, not just by the website.
  • Card payments are handled by Stripe; we never see or store card numbers.
  • Forms are protected against automated abuse.
  • Access keys are kept out of the website and the code.

Reporting a vulnerability

If you find a security problem, email thomas.michael.rees@gmail.com with the details. Please do not access other people's data, and give us reasonable time to fix it. We will acknowledge within 3 working days. We do not run a paid bounty programme.

Last updated: 18 October 2026.