Responsible Disclosure Policy

In this policy, references to “Starling Bank”, “us”, “we” and “our” mean Starling Bank Limited, a company incorporated and registered in England and Wales, with registered company number 09092149 and with registered address at 5th Floor, London Fruit And Wool Exchange, 1 Duval Square, London, E1 6PW.

Responsible Disclosure Policy

It’s important that anybody is able to contact us, quickly and effectively, with security concerns or information pertinent to our customers’ privacy or the confidentiality, integrity or availability of our systems. Therefore we operate a responsible disclosure policy to help security professionals and others alert us swiftly with the minimum of fuss.

If you believe you have identified a vulnerability, please read through the submission terms below and use one of the means below to contact us.

The terms below apply to any website, application or service distributed by or hosted by Starling Bank or served under a domain name owned by Starling Bank.

You can use our email address or technical partner to alert us to:

vulnerabilities or breaches in our software or environments which threaten the confidentiality, integrity or availability of our data or our customers’ data
“copycat” applications or phishing attacks even if they do not originate from Starling Bank sources
activity, discussion or data in any public forum which you believe constitutes a threat to Starling Bank or our customers

Responsibilities

At all times act responsibly and in the best interests of Starling Bank and our customers.

Do not break the law
Do not use social engineering techniques against our customers or staff
Do not put any Starling Bank or customer data at risk
Do be specific
Do provide a detailed and complete submission (masking or encrypting if necessary)
Do reference existing vulnerability information where relevant

It is important that we treat your communication as a responsible disclosure and not an attack or extortion. Following these guidelines will help to ensure that. We act decisively on attacks and extortion attempts including reporting them to the police.

How to disclose a security issue to us

Please use the sections below to make your submission.

By emailing or providing a disclosure to us, you agree to the terms of our [/legal/privacy-notice/](Privacy Notice) and that we can use your submission and its contents to ensure the security, integrity and reliable operation of our technology and business.

If you are uncomfortable sending any of the following content by email, you may mask or redact sensitive content or encrypt data using the PGP key included at the bottom of this page.

Your submission should contain:

clear description and evidence of the vulnerability (logs, screenshots, responses)
detailed steps to reproduce the issue
any platforms, operating systems, versions that are relevant
any relevant IP addresses or URLs
any supporting evidence you have collected (logging, tracing etc.)
your assessment of the exploitability or impact of the issue
your name, role (if appropriate) and contact details

Please preserve as much evidence as possible as we may need to examine it.

How we will respond

Our ability to respond quickly and effectively to important communication on this email address is important and therefore we take steps to manage spam and quickly identify the high quality submissions.

We discourage and will not respond to:

reports of generic vulnerabilities with no evidence of relevance to our systems
reports of any information already in the public domain
reports that are vague or non-actionable
anonymous reports

We will respond quickly and gratefully if we believe that you are faithfully reporting an issue in line with these terms and in the best interests of Starling Bank and its customers.

Recognition

We do not offer financial reward for submissions but we do believe in public recognition for anyone who helps us to ensure our systems and data are secure. We will not name you without your consent. If a public endorsement is appropriate we will discuss the details with you in advance.

We are actively working to put in place a bug bounty program that will facilitate and regulate financial reward for submissions but we cannot do so at this time.

Confidentiality

You must treat all information about our systems, staff or customers that comes into your possession or that you otherwise become aware of, which is not publicly available, as strictly confidential and not share or otherwise use it for any purpose other than emailing it to us as a submission as described above.

Submit a disclosure

Anyone can report an information security issue using our dedicated email address below.

[mailto:[email protected]](Send us an email)

Submit a technical disclosure If you have in-depth technical details such as CVSS scoring, CWE references etc, you may prefer to make your submission via our technical form.

[https://hackerone.com/starling_bank](Make a disclosure)

Other

If you are uncomfortable sending your submission by email, you may mask or redact sensitive content or encrypt data using the PGP key below.

Apply for a Starling bank account today and enjoy app-based banking at its best.

[/apply/](Start your application)

starlingbank.co.uk

starlingbank.co.uk

Details

Responsible Disclosure Policy