Vulnerability Disclosure Policy

How to report a security vulnerability in AVEQ products to us, and how we handle the report.

Purpose and Scope

This is our policy on coordinated vulnerability disclosure under the EU Cyber Resilience Act.

This policy covers

  • Surfmeter products, including Surfmeter Automator, Surfmeter Quality SDKs, Surfmeter Player SDKs and the Surfmeter server software
  • AVEQ services, including aveq.info and its subdomains
  • Public repositories of AVEQ on GitHub (aveq-research), except forks of third-party projects

Report a vulnerability in a third-party project to that project. If the vulnerability affects an AVEQ product through a third-party component, please also tell us.

Out of scope

Systems that a customer operates are out of scope, unless you have the permission of that customer. The following are also out of scope, unless you can show a real security impact:

  • Results of automated scanners
  • Missing security headers or best-practice recommendations
  • Version numbers alone
  • Self-XSS, clickjacking on pages without sensitive actions, and similar low-impact findings

How to Report

Send your report to security@aveq.info, in English or German.

Send your report by email to security@aveq.info. Do not open a public issue for a vulnerability. If you need an encrypted channel, ask for one in your first email, without details of the vulnerability.

Please include:

  • The affected product or service, and its version
  • A description of the vulnerability and its impact
  • Steps to reproduce it, or a proof of concept
  • How we can contact you, and if you want to be credited

Rules for testing

Please act in good faith:

  • Do not access, change or delete data that is not yours. Stop and tell us if you reach such data.
  • Do not interrupt or degrade a service, and do not run denial-of-service tests.
  • Do not use social engineering or physical attacks against AVEQ, our staff or our customers.
  • Use only as much access as you need to show the vulnerability.
  • Give us reasonable time to fix the vulnerability before you publish details.

We will not take legal action against you for research that follows this policy.

After Your Report

What you can expect from us, and how we coordinate publication.

What happens after your report

  • We confirm that we received your report within 3 working days.
  • We assess the report, and tell you the result and our planned next steps.
  • We fix confirmed vulnerabilities based on their severity and tell you when a fix is available.
  • We credit you in any advisory if you wish.

We do not currently pay rewards for reports.

Coordinated disclosure

We ask you not to publish details until a fix or mitigation is available. We aim to agree on a publication date with you, and suggest 90 days after your report as the default. We can agree on a later date if a fix needs more time, or an earlier one if the vulnerability is being exploited.

After a fix is available, we inform affected customers. We distribute security updates through our regular release channels. If the vulnerability is relevant to users in general, we also publish an advisory.

Reporting to authorities

If a vulnerability in one of our products is being actively exploited, we report it through the Single Reporting Platform of ENISA, as the Cyber Resilience Act requires. CSIRT Austria is our coordinating CSIRT. We may share information from your report for this purpose.

Handling of your data

We use your contact details only to handle your report. See our privacy policy for details.

Version 1.0, 4 November 2026. AVEQ GmbH, Vienna, Austria.