Responsible disclosure

Use the vulnerability report form on avonao.com or email security@avonao.com. Please do not file public issues or post details before the fix.

You can report anonymously through the form. An anonymous report carries no name or email address, and we do not record your IP address or browser details with it; our hosting provider keeps standard network logs, so use Tor or a trusted VPN if you need stronger anonymity. After sending, you receive a reference and a case key. Only a fingerprint of the case key reaches us, and a follow-up that presents the same reference and case key lets us link it to your first report. We cannot reply to an anonymous reporter, cannot credit one, and assess anonymous reports under the same targets as any other.

Include:

• what you found and its impact, in one or two sentences;
• the exact request, URL or steps to reproduce, using your own account;
• the time (UTC) of your test;
• your name or handle for recognition, if you want it, and how to reach you.

Please do not send secrets or other people's personal data in the report.

3. Scope

In scope

• avonao.com and id.avonao.com, and the sub-domains of Avonao ID that we operate;
• sign-in: passkeys, emailed links and codes, sign-in with Google, Microsoft or GitHub, authenticator apps and recovery codes;
• the OpenID Connect flow: authorization codes, PKCE, redirect URIs, tokens, consent and scopes;
• sessions and account security, including the security log;
• isolation between accounts, between businesses and between data regions (one person or business reaching another's data);
• the signing and publication of keys for sign-in tokens;
• the business console, invitations, domain verification, enterprise connections and webhooks, including the outbound request filter for webhooks.

Out of scope

• denial-of-service and load testing, volumetric attacks, and automated scanning that generates significant traffic;
• social engineering, phishing, and physical attacks against our people or our providers;
• attacks on third-party services, including Cloudflare, Stripe, Google, Microsoft and GitHub, or on any system you do not own (report those to the owner);
• findings that need a compromised device or browser, outdated browsers, or missing best-practice headers with no demonstrated impact;
• spam, content-injection without a security effect, and the lack of rate limiting on public pages;
• anything in the Terms or the Acceptable Use Policy that is a policy rather than a vulnerability;
• reports from automated tools with no demonstrated, working impact.

4. Rules for good-faith research

• Test only against your own account and data, or data you have explicit permission to use.
• Do not access, modify, keep or disclose other people's data beyond the minimum needed to show the issue, and stop and tell us at once if you reach it.
• Do not degrade the service for others, and do not use destructive techniques, such as deleting data or running denial of service.
• Do not use the issue to attack third parties, and do not pivot into internal systems.
• Give us a reasonable time to fix before you disclose. We ask for 90 days from your report, and will agree a shorter or longer period with you if there is good reason.
• Follow the law, and do not ask for payment in exchange for not disclosing.

5. Safe harbor

If you act in good faith and follow this policy, we will:

• consider your research authorised for the purposes of the Terms and the Acceptable Use Policy, and not suspend your account for it;
• not start, or support, legal action against you for the research, including under computer misuse and anti-circumvention laws; and
• if a third party starts action against you for research that follows this policy, say that it was authorised by us.

This safe harbor covers only our systems. It does not cover third parties, and it does not apply to conduct outside this policy, such as accessing data beyond what is needed or extortion.

6. What to expect from us

These are targets, not guarantees. We will tell you if we expect to miss one, and why. After the fix we will tell you, and may coordinate publication of an advisory with you. If a vulnerability affects personal data, we handle it under the Data Processing Agreement and the Privacy Policy.

7. Rewards and recognition

We do not pay monetary rewards (no bug bounty). We will, if you wish, thank you by name or handle on request in the published advisory or release note for the fix. Tell us in your report how you want to be credited, or that you prefer to stay anonymous. We do not give credit for reports that break this policy.

8. security.txt summary

9. Contact

Security reports: the report form or security@avonao.com. Other matters: support@avonao.com.

EU notices

• Reporting a business: notice and action
• Ranking rules of Avonao Business Circle
• Digital Services Act
• EU Data Act

Corporate transparency

• Imprint
• Impressum
• Modern Slavery and Human Trafficking Statement

Program terms

• Startup Program Terms