A website called “UK visa portal” has been quietly collecting passport scans, selfies, and personal data from thousands of travellers who thought they were applying through official channels.

Its disclosure raises questions about what security researchers should expect from vendors, and how far in advance of its ...