Security & vulnerability disclosure

Reporting a vulnerability

Email security@averto.dev. A machine-readable version of this contact is published at /.well-known/security.txt in line with RFC 9116.

Please include, as far as you are able:

• The affected URL, endpoint or component.
• Steps to reproduce, ideally the minimum needed to demonstrate the issue.
• What an attacker could actually achieve with it. Impact is what lets us prioritise honestly.
• Any proof-of-concept code, requests or screenshots. Please redact real credentials or personal data before sending them.

Reports in English are easiest for us to action quickly, but send it in whatever language you are comfortable with rather than not sending it at all.

What we commit to

• We will acknowledge your report within 3 business days.
• We will tell you whether we consider it a valid issue, and why, so you are not left guessing.
• We will keep you updated while we work on a fix, and let you know when it ships.
• We will credit you by name or handle if you would like that, and stay quiet about your involvement if you would not.

Averto is a small team. We would rather give you a realistic timeframe and meet it than promise same-day turnaround we cannot deliver.

Safe harbour

If you make a good-faith effort to follow this policy while researching and reporting an issue, we will not pursue or support legal action against you for that research, and we will treat your work as authorised. If a third party brings action against you for activity conducted in line with this policy, we will make it known that your research was authorised.

If you are ever unsure whether something is in scope or whether a particular technique is acceptable, ask us first at security@averto.dev. Asking will never count against you.

Scope

In scope:

• averto.dev and www.averto.dev — this marketing site, including the free tools at /tools and their API endpoints.
• platform.averto.dev — the Averto application.

Out of scope:

• Third-party services we use but do not control. Please report those to the vendor directly.
• Denial of service, volumetric testing, and anything that degrades service for other users.
• Social engineering, phishing, or physical attacks against our staff or infrastructure.
• Raw automated scanner output with no demonstrated impact. We run scanners for a living — a report we cannot reproduce or that shows no exploitable consequence is not something we can act on.
• Missing hardening measures with no demonstrated impact, such as an absent security header or a cookie flag on a non-sensitive cookie. These are worth fixing and we do fix them, but on their own they are not vulnerabilities. Our own security headers checker says the same thing, and we hold ourselves to it.

Please do not

• Access, modify or delete data that is not yours. If you come across someone else's data, stop, and tell us what you found without keeping a copy.
• Run tests that could degrade the service for other people.
• Publicly disclose the issue before we have had a reasonable chance to fix it. Get in touch and we will agree a timeline together — we are not going to sit on it.

Rewards

We do not currently run a paid bug bounty. We will always credit you publicly if you want that, and we will tell you honestly rather than string you along. If that changes, this page will say so.

Testing the free tools

The tools at /tools deliberately make outbound requests to URLs that visitors supply, so we take server-side request forgery in them seriously and would particularly welcome reports there. Please test against hosts you own or against our own domains rather than using our infrastructure to send traffic at unrelated third parties.