generated: '2026-07-27'
method: searched
probe: true
source: well-known/scottishpower-security.txt
contact:
- mailto:security@opendatasoft.com
evidence:
- source: well-known/scottishpower-security.txt
  kind: security.txt (previously harvested)
policy: []
bug_bounty: null
provenance: >-
  This is the RFC 9116 security.txt served by spenergynetworks.opendatasoft.com,
  the host that actually serves the SP Energy Networks Open Data Explore API. The
  contact is Opendatasoft's platform security address, not a ScottishPower-authored
  vulnerability disclosure policy — it is recorded as the disclosure channel for the
  API host, and nothing more is claimed. No Policy: field is published, and no bug
  bounty programme (HackerOne / Bugcrowd / Intigriti) was found for ScottishPower,
  SP Energy Networks or Iberdrola. ScottishPower's own hosts return HTTP 403 to
  every anonymous request, so no first-party security.txt could be read from
  outside — absence here is unreadability, not confirmed absence.
scottishpower_first_party: false