Responsible disclosure policy

We take the security of our systems and data seriously. If you believe you have identified a security vulnerability in a system, service, or application that we own or control, we encourage you to report it to us so that we can investigate and address it appropriately. This policy is intended to provide a clear channel for good-faith security research and responsible reporting.

How to report

Please send vulnerability reports to infrastructure@aevean.com. If you need to send sensitive technical details, you may request our public encryption key or use another agreed secure communication method. Please include enough detail for us to understand and reproduce the issue, such as:

• affected URL, system, application, or asset
• description of the issue
• steps to reproduce
• potential impact
• screenshots, logs, or proof-of-concept where relevant

Scope

This policy applies to internet-facing systems, applications, websites, and services that are owned or controlled by us.

Third-party systems, platforms, or services that are not owned or controlled by us are out of scope, even if they are integrated with or referenced by our services. Reports should be submitted to the relevant provider for those assets.

Please do

• act in good faith and avoid harm
• report the issue as soon as reasonably possible
• keep information about the vulnerability confidential until we have had reasonable opportunity to investigate and remediate it
• provide sufficient detail to reproduce the issue

Please do not

• exploit the vulnerability beyond what is necessary to demonstrate its existence
• access, copy, modify, delete, or retain data that does not belong to you
• disrupt services, perform denial-of-service testing, or degrade user experience
• use social engineering, phishing, spam, malware, or physical attacks
• establish persistence, pivot to other systems, or attempt privilege escalation beyond minimal proof
• publicly disclose the issue without coordinating with us first

What you can expect from us

• we will acknowledge receipt of your report within 3 business days
• we will review the report and, where appropriate, request additional information
• we will use reasonable efforts to investigate and remediate validated issues
• we will keep you appropriately informed on progress where contact details are provided
• we will not pursue legal action for good-faith research that follows this policy and applicable law
• we will handle personal information you provide in accordance with applicable privacy requirements

Public disclosure

We ask that you do not publicly disclose vulnerabilities until we have had a reasonable opportunity to investigate and remediate them. Where public disclosure is appropriate, we prefer to coordinate timing with the reporter.

Rewards

We do not operate a bug bounty or guaranteed reward program unless explicitly stated elsewhere. We may acknowledge valid reports at our discretion.