New web page

[Awaywego]

First thoughts, it looks and seems more professional.

On the down side not impressed with “Inner circle” yet another money grabbing scheme.
Where’s the we’re all in it together gone? £6 per month for exclusive interviews and extra match footage.
Plus early access to match tickets and away allocations before general sale, wonder how that’s going to work did the club think we achieved promotion where home EFL clubs in the main hand over tickets for the away team to sell? On past history Rochdale, Chester and Hereford would say the club are a long way off before achieving that.
Most NL clubs sell via their own ticketing site anyway.
Wonder whether you’d have legal regress if they failed to deliver having paid for a service?
Who knows but more separation between fans is not a good look, after all we are Just a National League club not some premiership outfit.

[saleiron]

Does “inner circle” (sounds a bit Masonic) give members priority to tickets above season ticket holders? Surely not.

[alcazar]

Want to bet it does?
Looks like another money making idea

2 users thanked author for this post.

ironfromafar, Awaywego

[saleiron]

What happened to United we Stand? I wonder if fans’ groups were consulted?

[CMC]

Wonder who came up with this, someone and his lackies.

[Iron-awe]

Already pay a tenner a month for the club draw thingy and if you pay an extra £6 a month it’s only watching a rehash of every post and pre match interviews that sound basically the same every week. Think I’ll pass.

2 users thanked author for this post.

alcazar, Awaywego

[mistertonmick]

it looks great but a bit cramped for us old ones on a iPhone

[Bishops Finger]

It is ai slop

1 user thanked author for this post.

alcazar

[SST]

Is this the club’s attempt at the content side of the FC100 offering? I don’t mind them trying to monetise, but I have 0 interest in behind the scenes content or videos of a group of blokes running up and down a training field. I’m sure they will get some sign ups though.

1 user thanked author for this post.

alcazar

[Awaywego]

Must admit they’ve done a great job with the site very informative, that’s more like it Scunny, shame about the inner circle but hey ho it is scunny after all.
Easy links down the bottom of the page for all social media platforms, not being tech savvy liked the Facebook and YouTube links.
Done a very good job with the venue hire pages with costings for room hire for all occasions, just feel they need to push this somehow all around the town for all those who have sod all to do with football.
Once again well done Scunny.

[CMC]

Wasn’t “Iron Insider” a social media account during you know who’s tenure?

[ironfromafar]

SST wrote:

Is this the club’s attempt at the content side of the FC100 offering? I don’t mind them trying to monetise, but I have 0 interest in behind the scenes content or videos of a group of blokes running up and down a training field. I’m sure they will get some sign ups though.

Yep .. agree
like the new site but they can stick the 6 quid a month pocket rifling scam where the sun dont shine .. UNITY , WHERE IN THIS TOGETHER ..what a load of tosh.

4 users thanked author for this post.

another fed up fan, alcazar, Iron-awe, Awaywego

[SODIron]

I’ve done a quick look at the site with my IT security / governance head on and, straight away, there’s one obvious issue.

### Admin account details appear to be exposed in the UI

If you click your profile image as a member, the menu includes:

* Dashboard
* Match Content
* My Card
* Admin Panel
* Sign Out

If you click **Admin Panel**, it displays the default account of admin@scunthorpe-united.co.uk

That’s not ideal. In general, you don’t want to advertise the identity of a potential privileged/admin account to every authenticated user. On its own it’s not proof of compromise, but it does hand an attacker useful reconnaissance material for phishing, password-spraying, credential stuffing and social-engineering attempts.

From a security and governance point of view, privileged account identifiers and internal admin paths should only be exposed where there is a genuine operational need. Standard users should be shown the minimum data and functionality required for their role. In practice, this comes back to the principle of **least privilege**, **deny by default**, and not exposing privileged functionality or admin artefacts to users who have no business need to see them.

Relevant guidance includes:

* **NCSC – Secure design principles**
https://www.ncsc.gov.uk/collection/cyber-security-design-principles

* **NCSC – Secure system administration**
https://www.ncsc.gov.uk/collection/secure-system-administration

* **NCSC – Use privileged access management**
https://www.ncsc.gov.uk/collection/secure-system-administration/use-privileged-access-management

* **OWASP Top 10 – A01: Broken Access Control**
https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/

* **OWASP Authorization Cheat Sheet**
https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html

* **OWASP Access Control**
https://owasp.org/www-community/Access_Control

* **OWASP Authentication Cheat Sheet**
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

So in plain English: even if that email address is “only” an admin identifier and not a secret in itself, there’s no obvious reason for it to be visible to ordinary members. At best it’s untidy and leaks internal implementation detail; at worst it gives attackers a cleaner starting point for targeting privileged access.

1 user thanked author for this post.

CMC

[saleiron]

This is very helpful. I wish the club would also look for some expertise among it fanbase on PR and Comms. The launch process has been amateur to put it mildly. It would be so much better to engage with, rather than ignore or gaslight, critical voices and sources of expertise that challenge the club.

[Awaywego]

See they’ve backtracked on the priority tickets access and rightly so season ticket holders should have first dibs. Lol.

[saleiron]

I would feel more sympathy if they owned these missteps.

[64]

Site looks awful, it’s fussy and just as daft when it comes to accessing basic info.

[Author]

Posts