Relocate vulnerability disclosure policy to https://security-guidance.service.justice.gov.uk/

[cybersquirrel]

For various historic and dull reasons, our original vulnerability disclosure policy was put (and is still) here:
https://mojdigital.blog.gov.uk/vulnerability-disclosure-policy/

In practice there's no real reason why we couldn't have it under https://security-guidance.service.justice.gov.uk/ now. I know it felt odd to link off of gov.uk when it was originally established, and our guidance and policy wasn't under .gov.uk, but that has now changed.

This would also need a tweak to our security.txt files, and the hall of fame content moving over too.

[warmanaMOJ]

Absolutely - although we might also consider:

https://www.gov.uk/help/report-vulnerability

... including the possibility of a dedicated sub-page, similar to:

https://www.gov.uk/guidance/report-a-vulnerability-on-a-dwp-system.

[cybersquirrel]

Yes that would be fine, but wouldn't want to lose the hall of fame element.