Report a security problem

How to tell us

Your report must include:

• the exact page or web address;
• the steps to make it happen again;
• proof of real impact, for example a screenshot from your own test account showing what you should not be able to see or do.

What we do not accept

• Output from a scanner or an AI tool, without proof that it works on our site.
• "Best practice" points, such as missing headers or email settings (SPF, DKIM, DMARC).
• Theoretical problems with no working proof.
• Problems that need your own device or login to be taken over first.
• Overloading the site (denial of service).
• Phishing or tricking our staff.

Reports that don't meet these rules are closed without a reply.

Rules for testing

• Test only with your own account. Never look at, change, download or keep anyone else's information. If you see it, stop and tell us.
• Never bid, pay, make offers or start transfers on real lots.
• Tell no one else about it before we have fixed it.

What happens next

• You get one automatic email confirming we received it.
• If your report meets the rules, a person replies within 1 working day and tells you how serious we think it is within 3 working days.
• A serious problem is switched off or fixed within 72 hours; others within 30 days. We tell you when it is fixed.
• If anyone's personal information was exposed, we follow our data-leak plan and tell the Information Regulator and the people affected, as the law requires.

We do not pay for reports.

Acting in good faith

If you follow every rule on this page, test only with your own account and report to us in good faith, we will not take legal action against you because of your report. This page is not an invitation to test our site, and this promise never covers looking at, changing or keeping other people's information.

Not a security problem?

For a problem with a listing, a payment, a transfer or your account, our support team can help.