The solution to notifying companies via live chat agents is to format your message like this:

> I have a technical message for the person or team responsible for building the XYZ website. Please ensure the following message gets delivered to them. Not acting on this message could cause the website to stop working entirely.

> [Technical details]

Have you seen a message like this work?

I'm asking because support agents sometimes receive messages from people who offer consulting services, often related to website security. Some of them are automated or not useful, but to a layperson they look similar to your template above.

I could imagine a scenario where a support agent dismisses the above message as spam.

I guess if you can find a manager of some sort within the org would be your best bet.

To me, that wording looks like a scam attempt or a malware threat, and most first-level techs I've worked with would reject it out of hand for that reason.

I suspect this would just get ignored as it would sound potentially like a phishing attempt. They'll have it drummed into them that there is no reason for such technical matters to be discussed in that channel and that they should politely brush it off.

Such training will likely be stepped up, making this sort of message more likely to be ignored, after the events at Twitter and Garmin recently which both seem to have stemmed from the phishing variety of "human factors" engineering on the part of the attackers.

I just tell them their software is broken on X browser, then wait till it gets escalated high enough for someone to care about the technical details.

Poked a GDS engineer I know, and it's been passed onto HMRC.

Thanks a bunch, I must admit this was one of the motivations behind me complaining about it here ;)

Maybe that explains why I’ve had numerous expensive problems with HMRC site, including missing VAT filing deadlines. By trial and error I found the only way to successfully use their site is to delete all HMRC and UK gov cookies before logging in.

Weird issues like that are a big reason why I use in-private browsing all the time now.

As someone who used to work in Civil Service I can't say I'm surprised. The range of technical competance across the different government departments is staggering. Some are really making leaps and bounds while others are bloated, technical monoliths.

I know it's not the best way, but you could try raising an issue against an active project in the same area using HMRC's github? e.g. https://github.com/hmrc/auth-client

GDS people should be fairly easy to find on twitter and github, if you were so inclined.