We welcome reports from security researchers. If you believe you have found a vulnerability in an Aesparrow website or service, please tell us privately so we can fix it before it is disclosed publicly.
How to report
Email info@aesparrow.com with the subject “Security vulnerability report”. Include the affected URL or component, a description of the issue, steps to reproduce and any proof-of-concept. Our machine-readable contact details are published in security.txt.
Our commitment
- Acknowledge your report within three business days.
- Keep you informed while we investigate and fix the issue.
- Credit you, if you wish, once the issue is resolved.
- Not pursue legal action for good-faith research that follows this policy.
What we ask of you
- Do not access, modify or delete data that is not yours, and stop once you have proof of the issue.
- Do not perform denial-of-service, social engineering, spam or physical attacks.
- Give us reasonable time to remediate before any public disclosure.