Security
Vulnerability Disclosure Policy
We welcome reports from security researchers. If you believe you have found a vulnerability in a system operated by AeroVerix Security, please tell us so we can fix it. This policy explains what is in scope, how to report, and how we will respond.
Scope
- In scope: www.aeroverix.com and other web properties operated by AeroVerix Security.
- Out of scope: systems belonging to our clients, third-party services we use (for example hosting, analytics or form providers), and findings from automated scanners without a demonstrated security impact.
How to report
Email contact@aeroverix.com with the subject line "Vulnerability report" and include:
- the affected URL or system and the type of vulnerability;
- clear steps to reproduce it, with any proof-of-concept, screenshots or requests;
- the impact you believe it has;
- how we can contact you for follow-up questions.
Please do not
- access, change or delete data that does not belong to you, beyond the minimum needed to show the issue;
- run denial-of-service, spam or social-engineering attacks, or physically test our offices;
- use automated scanning that degrades the website for other visitors;
- disclose the issue publicly before we have had a reasonable time to fix it.
What you can expect from us
- We aim to acknowledge your report within 5 working days.
- We will keep you updated while we investigate and fix the issue.
- With your permission, we will credit you once the issue is resolved.
Safe harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, will not pursue legal action against you, and will work with you to understand and resolve the issue quickly.
Machine-readable contact details are published at /.well-known/security.txt. For security services, see our penetration testing page.