Reporting a security flaw

Where to send it

Email

hello@ave17.com, with SECURITY in the subject line

Acknowledgement

within two working days

Machine-readable

https://ave17.com/.well-known/security.txt

Plain email is enough. If you would rather encrypt it, say so in a first message and we will send you a key before you send anything else.

What we promise you

• We acknowledge within two working days, from a person rather than a robot
• We tell you whether we agree it is a flaw, and if we do not, why
• We keep you informed while it is being fixed rather than going quiet
• We aim to have a fix in place within 90 days, and within 120 where the flaw runs deep enough that a correct fix takes that long. This is a statement of intent about our own behaviour, not a service level: clause 7 of the terms still makes no promise about availability
• We will not threaten or bring legal action against anyone who reports in good faith under the conditions below
• We credit you by name when it is fixed, unless you would rather we did not

Reports are handled under the disclosure process described here.

What we ask of you

• Give us a reasonable chance to fix it before telling anyone else. We ask for 90 days, and if a fix genuinely needs longer we will say so and explain why rather than let the clock run out in silence
• Do not access, change or delete data beyond the minimum needed to show the problem exists
• Do not degrade a service anyone else is using: no denial of service, no load testing, no spam
• Do not use social engineering, physical intrusion, or anything aimed at our staff or our customers rather than at the system
• Stay inside what is ours. Our customers run their own deployments; a flaw in one of those is theirs to be told about, and we will pass a report on if you ask us to
• If you come across personal data, stop reading it. Do not download it, do not keep a copy, and do not paste it into the report. Tell us what kind of data it was and how you reached it, and that is enough for us to find it ourselves
• Please do not point an automated scanner at us. A crawl adds nothing we cannot find with the same tool ourselves, its findings are out of scope below, and its traffic is indistinguishable from an attack, so it costs us an incident and costs you the benefit of the doubt

The first of those two is a request on somebody else's behalf rather than on ours. Personal data reached by accident belongs to a person who never agreed to any of this, and nothing in this policy is ours to waive for them.

What is in scope

Anything served from ave17.com and our other company addresses listed below, the mail service behind hello@ave17.com, and any software we wrote and published.

• Out of scope: findings from an automated scanner with no demonstrated impact
• Out of scope: missing hardening headers with nothing behind them
• Out of scope: reports about third-party open-source software we deploy but did not write, which belong upstream — tell us as well and we will help get them there
• Out of scope: anything that requires physical access to a machine, or an account you obtained without permission

Complaints about content, and why there is no form for them

We host no user-provided material. There is no account to open here, no way for anyone but us to publish a word on this site, no forum, no comments and no uploads. AVE17 LTD is responsible for what is published on this site.

That is why there is no notice-and-action mechanism and no illegal-content reporting form. Articles 16 to 18 of the Digital Services Act put those on a hosting service; a site that hosts nothing but its own words is not one, and a form that pretended otherwise would suggest a process that does not exist behind it.

• Something we published is wrong, out of date or unfair: write to hello@ave17.com and say which page. We correct or we explain, and the in-force date at the bottom of a legal page moves when its words do
• Something we published infringes your copyright or your trade mark: write to the same address, say what it is and where, and we will take it down while we look rather than after
• Material hosted by a customer on a deployment we run for them: that is theirs, and we are the processor. Tell them. Tell us as well and we will pass it on, but we do not moderate a customer's system and it would be a breach of their contract if we did

Clause 15d of the terms names our points of contact under articles 11 and 12 of the Digital Services Act. Those exist because an authority may need to reach a company, not because there is content here to complain about.

How to tell it is really us

Nine company addresses and one mailbox is a ready-made kit for anybody who wants to be mistaken for us. These are all of them, so you can check rather than guess.

Our sites

ave17.com, ave17.ca, ave17.eu, ave17.fr, ave17.de, ave17.it, ave17.es, ave17.uk, ave17.us

Separate seller

ave17.ge is a different seller under a different law. It is not operated by AVE17 LTD. Nothing is sold through it yet. Its own details will be published there.

Our mailbox

hello@ave17.com

Registered name

AVE17 LTD, number 17254143

• We never ask for a password, a recovery phrase, a card number or a two-factor code. Not by email, not on the telephone, not ever, and not even for a system we run for you
• We never send an invoice with new bank details out of the blue. If our details ever change you will hear it from a person you already deal with, and you should still ring back on a number you already had
• Every address of ours ends in one of the names above. A name with a word in front of ours, a hyphen in the middle of it or a different zone is not ours, however right the rest of it looks
• Mail from us is signed. If a message claiming to be from us fails its checks, your mail service will usually say so — believe it over the message
• When in doubt, do not reply to the message. Come back to one of the addresses above and write to the mailbox above from there

If you have been sent something that claims to be us and is not, we would like to see it. Forward it to hello@ave17.com with the words SECURITY in the subject, headers and all.

The law

Testing computer systems without authorisation is an offence under the Computer Misuse Act 1990. This page is our authorisation, for the scope above and within the conditions above, and only for those.

It cannot and does not authorise you against anybody else. If your testing reaches a system that is not ours, our permission does not cover it.

Section 170 of the Data Protection Act 2018 makes it a separate offence to obtain personal data without the consent of the controller. For our own systems we are the controller and this page is that consent, for the scope and the conditions above. For a customer deployment we are only the processor, so it is not ours to give: if your testing reaches personal data held for a customer, stop and tell us. Nothing here is a waiver of anyone else's rights, and it does not bind a customer whose deployment you happen to reach.

In force

This document has been in force since 10 November 2026.

10 November 2026

Updated.

31 August 2026

Updated.

27 August 2026

Updated.