While most '.gov.uk' sites accept security reports via HackerOne, the Environment Agency is not part of the program. Therefore, there was a 24-hour delay between finding the open redirect and ...