How do I report a vulnerability in AAVETech?
Key takeaways
- Report privately to hello@aavetech.com and we will acknowledge within one working day.
- Include reproduction steps, impact, and your contact details.
- We do not pursue legal action against good-faith research.
- We will keep you informed as the issue is fixed, and credit you if you want.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should we include?
- What the vulnerability is, and which system or component it affects.
- How to reproduce it, with the steps a reader can follow.
- The impact you believe it has, and who could exploit it.
- Any proof-of-concept you have, with an explicit note on whether it is safe to run.
- Your contact details, and how you would like to be credited.
What is out of scope?
- Social engineering of our staff, beyond a simple demonstration of the issue itself.
- Phishing or spam campaigns against our staff.
- Denial of service, or any action that degrades our services or our clients'.
- Accessing data that is not yours, including customer records.
- Automated scanning that generates excessive traffic or log noise.
- Using a third party's systems to reach ours.
What happens next?
| Stage | Timing | What happens |
|---|---|---|
| Acknowledgement | Within 1 working day | We confirm receipt and open a tracking reference. |
| Triage | Within 3 working days | We validate the report, assess severity and confirm the impact. |
| Fix | Agreed with you | We develop the fix and agree a retest with the reporter. |
| Retest | After the fix | The reporter verifies the fix, or we provide a sandbox to do so. |
| Disclosure | Agreed with you | We publish a credit if you want one, or keep it confidential if you prefer. |
What does safe harbour cover?
We will not pursue legal action for good-faith research that: is authorised in advance, avoids privacy violations, avoids data destruction, avoids service degradation, and is reported to us rather than exploited publicly. We will not hold you liable for anything that happens as a direct result of following our guidance in the report response. This is a commitment, and we put it in writing at the start of the process rather than after the argument.
What are the common questions about this?
Get a straight answer on this
Send us a short description of what you are dealing with and your deadline. You will get a fixed price band, a start date, and a direct answer on whether AAVETech is the right fit for the work.
Send us the details See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.