Found a security problem?

How to tell us

Email security@michaeljosem.com. Say what you found, where, and the steps to see it for ourselves. A short note is fine: you do not need a polished write-up.

What you may test

• The site at manxteams.com.
• The same site at its workers.dev address.
• The site's code repository, if you have been given access to it.

What is not covered

• The services the site uses, such as Cloudflare, Resend and OpenStreetMap. Report problems in them to those companies.
• Denial of service, or anything that slows the site down for other people.
• Sending the form many times, or filling the review queue.
• Social engineering, phishing or contacting the groups listed on the site.
• Scanner output with no demonstrated impact, such as a missing header or an email record, without a way to use it.

Rules

• Use the least data you need to show the problem.
• If you see personal data, especially anything about children, stop there and tell us. Do not keep, copy or share it, and delete anything you saved once you have told us.
• Send no more than a few test submissions through the form, and put "TEST" in the team name so we can spot them.
• Do not change or delete anything that is not yours, and do not try to stay in the system.
• Keep the details to yourself until the problem is fixed (see below).

Safe harbour

If you keep to this page in good faith, we treat your research as authorised. We will not take or support legal action against you for it, including for an accidental, good-faith step outside these rules. If someone else takes legal action against you over research that kept to this page, we will say publicly that you had our permission.

We can only speak for Manx Teams. We cannot give permission to test Cloudflare, Resend, OpenStreetMap or anyone else. You still need to keep to the law. If you are not sure whether something is allowed, ask us first at the address above.

What to expect

• We will reply within 7 days to say we have your report. A volunteer runs the site, so please be patient.
• We will keep you told as we look into it and fix it, and tell you when the fix is live.
• Coordinated disclosure: please wait until the fix is live, or 90 days from your report if that comes first, before you publish anything. If we need longer we will ask and say why.

No payment

Manx Teams is a free site run by a volunteer, with no budget. We do not pay for reports, and there is no bug bounty. Please do not send a report on condition of payment.

Thanks

With your agreement, we will thank you here by name, or by the name you prefer, once the fix is live. Nobody has reported a problem yet.

Safeguarding concerns

This is separate from security problems in the site.

• If anyone is in immediate danger, call 999.
• If you are worried about how a group or someone in it behaves, tell the group's own safeguarding lead or the national body it belongs to.
• If it is about a listing on this site, email michael@michaeljosem.com.

The FAQ says the same.

Changes to this page

If we change how we handle reports, we will update this page and its date. The machine-readable version is at /.well-known/security.txt.

This version: 3 October 2026.