The guidance covers how to report a potential security issue in an HMRC online service and what information to provide.

HMRC says anyone in this position should report the security flaw as soon as possible and should avoid doing anything to exploit the vulnerability.

To help HMRC understand the nature and scope of the issue, if possible a report should include: the type of issue (for example, buffer overflow, SQL injection, cross-site scripting); the location of the bug or the relevant URL; a proof-of-concept or exploit code. It should also outline the impact of the issue, including how an attacker could exploit it.

Anyone who wants to encrypt their email before sending any details, should email HMRC and ask for a copy of its public key.

HMRC says it takes the security of online systems very seriously, and will investigate all reported vulnerabilities and take action where necessary. However, the department will only reply if further information is required.

To report a potential vulnerability, email [email protected]

Guidance Report a security vulnerability in an HMRC online service is here.

Report by Pat Sweet