Responsible Disclosure
How to report a security vulnerability in Aureon's own systems, and what you can expect from us.
Our commitment
We take the security of our own systems as seriously as we take our clients'. If you believe you have found a vulnerability in a system operated by AUREON INTELLIGENCE L.L.C-FZ, we want to hear from you, and we will treat you fairly.
Scope
This policy covers systems owned and operated by Aureon, including:
- aureonintelgroup.com and its subdomains;
- email infrastructure for aureonintelgroup.com.
Systems operated by our clients, suppliers or partners are out of scope. Please report issues affecting them to the relevant organisation. If you are unsure, ask us.
How to report
Email info@aureonintelgroup.com with the subject line "Security vulnerability report". Please include:
- a description of the issue and its potential impact;
- the affected system, URL or component;
- steps to reproduce, including any proof-of-concept;
- your name or handle and how you would like to be credited, if at all.
If you need to send sensitive details, tell us and we will provide an encrypted channel. A machine-readable version of this policy is published at /.well-known/security.txt.
What we ask of you
- Act in good faith and avoid privacy violations, data destruction and interruption or degradation of our services.
- Do not access, modify or exfiltrate data beyond what is necessary to demonstrate the issue. If you encounter personal or confidential data, stop and report it immediately.
- Do not perform denial-of-service testing, social engineering of our personnel, physical attacks or testing of third-party systems.
- Give us reasonable time to remediate before public disclosure, and coordinate the disclosure with us.
What you can expect from us
- Acknowledgement of your report within 3 business days.
- An initial assessment and expected remediation timeline within 10 business days.
- Regular updates until the issue is resolved.
- Credit for your finding, if you wish, once the issue is fixed.
- No legal action against researchers who comply with this policy. We consider good-faith research conducted under this policy to be authorised, and we will not pursue claims under computer misuse or similar laws for such activity.
Out of scope findings
The following are generally not accepted unless chained to a demonstrable security impact: missing security headers without a working exploit, software version disclosure, clickjacking on pages without sensitive actions, email configuration findings on domains we do not own, and reports produced solely by automated scanners.
Thank you
We are grateful to the security community for helping keep our systems safe. Reports that improve our security will be acknowledged publicly if you wish.