Report a vulnerability
Last updated 2026-09-01
If you have found a security issue in any Avieros property, this page tells you exactly where it goes, who reads it, and how long you will actually wait — not a service level copied from a company with a support team.
The founder, and the workforce that assists him. There is no security desk, no triage rota, and no ticketing system between you and the person who can fix it. His inbox is the response time. That is the real answer, and it is better than a fabricated one: a report sent on a weekday usually gets a human reply within a day or two, and a report that looks like an active compromise gets one much faster because it interrupts everything else. If you need a contractual response window, Avieros does not have one to offer.
Send the report
Submit report Opens a message to privacy@avieros.com with the subject SECURITY and the questions below already filled in as a template.
There is no web form here on purpose. This site runs no JavaScript and its own policy forbids submitting a form to anywhere, which is a deliberate part of how the Trust Center is hardened. A form that posted your report somewhere would mean weakening exactly the thing this page is about. Your mail client is the submission channel.
What to include
- What you found, in a sentence.
- Where — the URL or the surface.
- How to reproduce it. This is the part that decides how fast it gets fixed.
- What an attacker could do with it, in your view.
- Anything you actually accessed. Tell us. It is not held against you and it changes what has to be notified.
Safe harbour, and its limits
- Good-faith research is welcome. Research that does not access, alter, retain, or exfiltrate other people’s data will not be met with legal threats.
- Please do not run denial-of-service or load testing, use automated scanners that could degrade the service for others, social-engineer anyone, or access an account that is not yours. If you can demonstrate an issue without touching real data, do it that way.
- Stop at the proof. Once you have shown a thing is possible, stop. You do not need to establish how far it goes; that is our job.
- This is not a legal safe-harbour contract. It is a written commitment from a small company, and it is stated as such rather than dressed up as one.
What happens after you send it
| Step | What happens |
|---|---|
| 1. Read | A human reads it, not a classifier. You get an acknowledgement that a person has seen it. |
| 2. Severity | It is placed on the SEV-1 to SEV-4 ladder, which decides the clock and the first move. Cross-tenant access, credentials, or anything touching money is SEV-1 and is contained before it is diagnosed. |
| 3. Contain, then fix | Containment first — revoke, cut the integration, or roll production back to the last known-good deployment. The fix follows. |
| 4. Tell you what happened | You are told what it was and what was done. If other people were affected, notification passes a counsel gate rather than being decided by whoever would least like to send it. |
| 5. Credit, if you want it | Happy to credit you by name. There is no bug bounty — no money, and saying so up front is fairer than letting you find out after the work. |
The full incident process, including which of its containment controls is not yet verified, is on the Security page.
Back This site runs no script, so it cannot know where you came from and will not pretend to. The Trust Center overview is here.