Draft
Responsible disclosure
Found a vulnerability in advolo.org or the Advolo platform? Tell us, and we will work with you to fix it.
How to report
E-mail hello@advolo.org with a description, the steps to reproduce and, if possible, a proof of concept.
We ask you to
- report the vulnerability as soon as possible after finding it;
- not access, change or delete more data than needed to show the problem, and delete any data obtained afterwards;
- not share the vulnerability with others until it is fixed;
- not use social engineering, physical attacks, denial of service, spam or automated scanning that affects other users;
- not use the website widget or the demo to attack customers’ websites.
We promise to
- confirm your report within 3 working days and give an assessment and expected fix date within 10 working days;
- keep you informed until the problem is solved;
- not take legal action when you follow this policy;
- treat your report confidentially and, if you wish, name you as the finder once it is fixed.
Out of scope
Findings without a security impact, missing headers without a demonstrated risk, and vulnerabilities in third-party services.
Draft of 11 November 2026 · All legal documents