Responsible Disclosure
At AHTI, we take the security and privacy of our systems and users seriously. If you discover a potential security vulnerability in one of our systems, applications, or services, we appreciate you reporting it to us responsibly.
Reporting a vulnerability
Please report potential security vulnerabilities to:
Please include, where possible:
- A description of the vulnerability;
- The affected system, application, URL, or endpoint;
- Steps to reproduce the issue;
- The potential impact;
- Any supporting evidence, such as screenshots, request/response examples, or proof-of-concept code;
- Your contact details, if you would like us to keep you informed about our investigation.
Please do not include personal data or other sensitive information unless this is necessary to demonstrate the vulnerability.
What we ask from you
When investigating a potential vulnerability, please:
- Do not access, modify, copy, delete, or disclose data beyond what is strictly necessary to demonstrate the vulnerability;
- Do not attempt to obtain access to accounts or information belonging to other users;
- Do not perform denial-of-service attacks or other activities that may affect the availability or performance of our systems;
- Do not use social engineering, phishing, physical attacks, or attacks against AHTI employees, suppliers, or users;
- Do not install malware or establish persistent access to our systems;
- Do not use automated scanning that generates excessive traffic or materially impacts our services;
- Stop testing and contact us if you unexpectedly gain access to sensitive, personal, or confidential information;
- Allow us reasonable time to investigate and remediate the issue before publicly disclosing it.
What you can expect from us
If you act in accordance with this policy, we will:
- Acknowledge your report and assess the reported vulnerability;
- Treat your report confidentially;
- Keep you informed of relevant progress where reasonably possible;
- Work to remediate confirmed vulnerabilities based on their severity and risk;
- Not pursue legal action against you solely for good-faith security research performed in accordance with this policy.
If you have unintentionally accessed information that you were not authorised to access, please report this immediately and do not retain, use, or further disclose that information.
Scope
This policy applies to internet-accessible systems, applications, and services operated by AHTI.
Systems or services operated entirely by third parties may be outside our control. If you are unsure whether a system is in scope, please contact us before conducting further testing.
The following activities are explicitly out of scope:
- Denial-of-service or load testing;
- Social engineering or phishing;
- Physical security testing;
- Testing of third-party infrastructure not operated by AHTI;
- Automated testing that may degrade system availability;
- Attempts to access, extract, alter, or delete data belonging to other users.
Disclosure
Please do not publicly disclose a vulnerability before AHTI has had a reasonable opportunity to investigate and address it.
We are happy to discuss coordinated disclosure once the vulnerability has been assessed and, where applicable, remediated.
Rewards
AHTI does not currently operate a bug bounty programme. Reporting a vulnerability therefore does not create an entitlement to financial compensation or another reward.
We nevertheless greatly appreciate responsible reports that help us improve the security of our systems.
Contact
Security reports can be sent to: