Last updated: 22 October 2026
Lesson Diary holds diaries, pupil records and payment history for driving instructors and their pupils. If you find a security weakness in Lesson Diary, we want to hear about it. This policy tells you how to report it, what you may and may not do while you look, and what we do in return.
How to report a vulnerability
Email support@lessondiary.co.uk with "Security" in the subject line. Include:
- what the problem is and where it is (the page, the API endpoint or the app version);
- the steps to reproduce it;
- what an attacker could do with it.
Send only the personal data you need to show the problem. If you saw data that belongs to someone else, describe it rather than send it.
What we do when you report
- We reply within 3 working days to confirm we have your report.
- We keep you informed while we investigate and fix the problem.
- We tell you when the fix is live.
- If you want, we credit you by name when we talk about the fix.
Safe harbour for good-faith research
If you act in good faith and follow the rules below, we consider your research authorised. We will not take legal action against you or report you to the police, under the Computer Misuse Act 1990 or any other law, and we will not treat your research as a breach of our Acceptable use policy. If someone else takes action against you for research done under this policy, we will make it known that you had our authorisation.
Rules for research
- Test only against an account you own. Make a free account for your tests.
- Stop when you reach data that is not yours. Do not copy, keep, change, delete or share that data, and tell us at once.
- Do not disrupt the service. No denial-of-service attacks, and no automated scanning at a volume that slows the service for other users.
- Do not contact, trick or phish our staff, instructors or pupils, and do not send messages to them through the service.
- Do not try to get physical access to our offices or equipment.
- Give us 90 days to fix the problem before you tell anyone else about it, unless we agree a different date with you.
- Do not ask for payment in exchange for the details of a problem.
When safe harbour does not apply
Safe harbour is for people who help us protect our users. It does not apply if you:
- access, download, keep, change or delete data that belongs to someone else, beyond what you need to show the problem;
- disrupt the service, or make it slower or unavailable for other users;
- demand money, or threaten to publish a problem or data unless you are paid;
- publish a problem or any data before we fix it;
- break any of the rules above on purpose.
In those cases we keep the logs as evidence, report the matter to Action Fraud and the police, and take criminal and civil action against you. We do not pay ransoms.
Out of scope
These do not qualify, unless you show a real effect on the security of our users:
- reports from automated scanners with no proof that the problem can be exploited;
- missing security headers, cookie flags or email settings (SPF, DKIM, DMARC) with no attack that uses them;
- clickjacking on pages that have no sensitive actions;
- rate limits on actions that are not sensitive;
- attacks that need the victim to paste code into their own browser (self-XSS);
- problems that need a rooted or jailbroken phone, or an out-of-date browser;
- problems in services we use, such as Stripe, Apple or Google. Report those to the company that runs the service.
Rewards
We do not run a bug bounty and we do not pay for reports. We credit reporters who want to be credited.
Machine-readable contact
Our contact details for security reports are also at /.well-known/security.txt, in the format that RFC 9116 sets out.