Supporting Brave Futures: how a Google bug bounty helped us double our impact

Colleagues from Candour and Brave Futures holding a large cheque for £10,000 which is a donation to Brave Futures

In 2024, we chose Brave Futures as our charity partner of the year. Brave Futures is a specialist support service for children and young people who have experienced sexual abuse.

Based in Norfolk and Suffolk, Brave Futures helps children to develop skills and tools to rebuild their futures, overcome challenges and realise their skills and strength. They also run prevention and education and family support services.

Our support included a £10,000 used towards funding the Norfolk and Suffolk-wide Education and Outreach project which aims to raise awareness and encourage early prevention.

Brave Futures research shows that child sexual abuse begins around the ages of 6 and 7, and one in ten children experiences it. In 2024 there were approximately 17,000 child victims within Norfolk meaning age-appropriate awareness and sex education are vital, not just for children but for parents and schools. Raising awareness leads to prevention and early intervention.

The funds donated have enabled us to reach hundreds of children, teaching them about boundaries and consent. Through these interventions, we hope to have been able to guide people to our services and, importantly, to prevent children from experiencing child sexual abuse. Donations like this make our work possible.

Hannah Walker, Fundraising and Marketing Manager

In April, the Candour team braved the cold weather and formed a team to enter the Brave Future’s Dragon Boat race event – raising £1,270.

A female Candour colleague, wearing a buoyancy aid, is sitting at the front of a dragon boat on a river. There is a large drum in front of her.

In October, we were able to make a second £10,000 donation to Brave Futures, having received an unexpected cash reward from Google’s Bug Bounty programme.

While working on the development of AlsoAsked, the team discovered a vulnerability, allowing us to access a private API endpoint which detailed specific names and values used to rank websites. After reviewing our exploit submission, Google rated it “high impact” with a “high probability” and after many months of tiresome admin efforts from Mark, the payout was processed.

The second donation was used to fund one-to-one parent sessions. The sessions focus on supporting parents as they navigate their child's trauma, equipping them with the tools needed to provide long-term support and foster reconnection. Many parents and carers struggle with feelings of guilt and a sense of loss over their child’s disrupted childhood, so a key part of these sessions is helping them manage those emotions and empowering them in their role.

White text on a black background which reads: Hello, Google Vulnerability Reward Program panel has decided to issue a reward of $13337.00 for your report. Congratulations! Rationale for this decision: Exploitation likelihood is high. Issue qualified as an abuse-related methodology with high impact.

Hannah Walker, Fundraising and Marketing Manager
“Since being chosen as the charity of the year for 2024, the support from Candour has been significant. We are deeply grateful to everyone at Candour for understanding the value our service provides to children, young people, and their families, and for their ongoing support—not just financially, but also through utilising their team's skills and raising awareness of the work we do and the prevalence of child sexual abuse.”

We rounded off the year by donating ticket sales from SearchNorwich 19 – raising £335.

We’re so proud to have been able to raise so much money throughout 2024 and want to thank Brave Futures for the valuable work they continue to do.

For 2025, we've already started working with our new charity partner, Norfolk Clubhouse, and we'll share details about that as soon as we can.