We take the security of Aero Reg seriously, and we are grateful to the security researchers who help us keep it safe. This policy explains how to report a vulnerability, what is in and out of scope, and our commitment to you if you report in good faith.
How to report#
Email security@aeroreg.co.uk with enough detail for us to reproduce and assess the issue:
- The affected URL, endpoint, or component.
- A clear description of the vulnerability and its potential impact.
- Step-by-step instructions to reproduce it, including any proof-of-concept.
Our machine-readable contact details are also published at /.well-known/security.txt.
Our commitment to you#
If you make a good-faith effort to follow this policy when reporting an issue, we will:
- Acknowledge your report and work with you to understand and resolve it.
- Keep you informed of our progress as we investigate and fix it.
- Not pursue or support legal action against you for your research, provided you act within this policy.
- Credit you for the discovery once a fix has shipped, if you would like us to.
We consider security research and vulnerability disclosure conducted in line with this policy to be authorised, and we will not treat it as a breach of our Terms. This safe harbour does not apply to activity that goes beyond what is described here.
Scope#
This policy covers the Aero Reg website and API at aeroreg.co.uk and its subdomains. Vulnerabilities in third-party services we rely on (for example, PayPal) should be reported to those providers.
Out of scope#
The following are generally not eligible and should not be tested:
- Denial-of-service, volumetric, or other attacks that degrade or disrupt the service.
- Social engineering or phishing of our staff, users, or contractors.
- Physical attacks against our premises or infrastructure.
- Spam, or reports generated solely by automated scanners with no demonstrated impact.
- Issues that require an already-compromised account, device, or network to exploit.
- Best-practice suggestions (such as missing headers) with no demonstrable security impact.
Rules for researchers#
To stay within this policy, please:
- Only test against your own accounts and data — never access, modify, or delete data belonging to others.
- Stop as soon as you have demonstrated a vulnerability, and do not exfiltrate any data.
- Avoid any action that degrades, disrupts, or damages the service or its users.
- Give us a reasonable opportunity to fix an issue before disclosing it publicly.
- Comply with all applicable laws.
Destroy or alter data, violate the privacy of our users, or publicly disclose a vulnerability before we have had a reasonable chance to fix it.
Recognition#
We do not currently run a paid bug-bounty programme, and reports are not eligible for monetary reward unless we have agreed otherwise in writing. We are, however, happy to publicly acknowledge researchers who responsibly disclose valid issues, where they wish to be named.
Contact & governing law#
Send reports to security@aeroreg.co.uk. How we handle any personal data in your report is covered by our Privacy Policy. This policy is governed by the law of England and Wales.