Reporting a Security Issue

Last Updated: 22 October 2026

If you think you have found a security vulnerability in We Sweep, please tell us. We would much rather hear about it than not.

How to report

Email security@we-sweep.co.uk with:

• what you found, and where (the page, app or address);
• the steps to reproduce it;
• what someone could do with it.

Please include only as much personal or business data as you need to show the problem.

We will acknowledge your report within 5 working days and keep you updated until it is resolved.

In scope

• www.we-sweep.co.uk
• widget.we-sweep.co.uk (the booking widget and the customer pages)
• businessadmin.we-sweep.co.uk, platformadmin.we-sweep.co.uk and fieldapp.we-sweep.co.uk
• the We Sweep API those apps call

Please don't

• Access, change or delete data that isn't yours, including other businesses' data and their customers' data. If you reach someone else's data, stop, and tell us what you saw.
• Make real bookings, payments or refunds, or cause emails or text messages to be sent to people who haven't agreed to it. If you need a test account, ask us first: we can give you access to a test business.
• Run denial-of-service tests or high-volume automated scans, send spam, or try to trick our staff, the businesses that use We Sweep, or their customers.
• Test the services we use (such as Stripe, Supabase, Vercel and Postmark). Report problems with those to them.

Our commitment

If you act in good faith and follow this page, we will not take legal action against you for your research, and we will work with you to understand and fix the problem. Please give us a reasonable time to fix it before you tell anyone else. We do not run a paid bug bounty.