Disclosure
Report a vulnerability in AAVETech
If you have found a security issue in AAVETech's systems, report it privately to hello@aavetech.com rather than disclosing it publicly. Include what you found, how to reproduce it, the impact you believe it has, and your contact details. We will acknowledge within one working day and will not pursue legal action against good-faith research that avoids privacy harm, data destruction and service degradation.
Key takeaways
- Report privately to hello@aavetech.com and we will acknowledge within one working day.
- Include reproduction steps, impact, and your contact details.
- We do not pursue legal action against good-faith research.
- We will keep you informed as the issue is fixed, and credit you if you want.
What to include
- What the vulnerability is, and which system or component it affects.
- How to reproduce it, with the steps a reader can follow.
- The impact you believe it has, and who could exploit it.
- Any proof-of-concept you have, with an explicit note on whether it is safe to run.
- Your contact details, and how you would like to be credited.
What is out of scope
- Social engineering of our staff, beyond a simple demonstration of the issue itself.
- Phishing or spam campaigns against our staff.
- Denial of service, or any action that degrades our services or our clients'.
- Accessing data that is not yours, including customer records.
- Automated scanning that generates excessive traffic or log noise.
- Using a third party's systems to reach ours.
What happens next
| Stage | Timing | What happens |
|---|---|---|
| Acknowledgement | Within 1 working day | We confirm receipt and open a tracking reference. |
| Triage | Within 3 working days | We validate the report, assess severity and confirm the impact. |
| Fix | Agreed with you | We develop the fix and agree a retest with the reporter. |
| Retest | After the fix | The reporter verifies the fix, or we provide a sandbox to do so. |
| Disclosure | Agreed with you | We publish a credit if you want one, or keep it confidential if you prefer. |
Safe harbour
We will not pursue legal action for good-faith research that: is authorised in advance, avoids privacy violations, avoids data destruction, avoids service degradation, and is reported to us rather than exploited publicly. We will not hold you liable for anything that happens as a direct result of following our guidance in the report response. This is a commitment, and we put it in writing at the start of the process rather than after the argument.
Last reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.