What to report
- A website vulnerability, authentication or authorization weakness, exposed secret, or unintended access to non-public information.
- A suspected compromise, malicious file, phishing page, defacement, or impersonation of an official municipal service.
- Personal data that appears publicly exposed or sent to an unauthorized recipient.
How to report safely
Use the subject “Website Security Report.” Include the affected address, date and time, a concise description, steps that reproduce the issue using a test account if possible, and the potential impact. Screenshots are helpful, but redact personal data, credentials, private tracking codes, and unrelated records.
Do not place exploit details or exposed data in a public post or citizen report. Ask for a safer transfer method before sending sensitive evidence or large files.
Responsible research boundaries
- Stop testing if you access personal data, non-public records, another user's account, or a system outside the stated website scope.
- Do not download, retain, alter, delete, or disclose data; create persistence; install malware; use denial of service; send spam; or use social engineering.
- Use the minimum interaction needed to demonstrate the issue and give the municipality reasonable time to investigate and remediate before any disclosure.
Important: This page does not authorize access or activity that would otherwise be unlawful, and it is not a promise of payment or a bug-bounty program.
What to expect
The municipality will triage the report, may ask for clarification, and will coordinate remediation based on severity and public risk. We aim to acknowledge useful reports, but operational or investigative details may need to remain confidential. Report immediate threats to life or public safety through emergency channels.