What we promise
We fix the most serious issues first. We will tell you when the fix is out and agree with you when the details can be shared.
How to report
Email security@adverant.ai. Please include:
- what you found and where (the URL, product area or component);
- the steps to reproduce it, with any proof-of-concept code or screenshots;
- what an attacker could do with it, as you see it;
- how to reach you, and whether you would like to be credited.
Write in English if you can. One clear report is more useful than several short ones. Please do not include personal data you came across; describe it instead.
What is in scope
- adverant.ai and its subdomains run by Adverant;
- Adverant Nexus as we run it in our EU cloud, including the AI switchboard, sign-in, and the open record verifier;
- Nexus software, installers and update packages you have a licence to run.
Out of scope: attacks on our people (phishing, social engineering), physical attacks, denial of service, findings that need an already compromised device, and reports from automated scanners without a demonstrated impact. A customer's own installation belongs to that customer; please report issues there to them as well as to us.
Testing rules
- Use only accounts and data that are yours, or that you were given for testing.
- Do the least needed to prove the issue. Stop and tell us as soon as you reach other people's data.
- Do not change or delete data, degrade service, or keep access longer than needed.
- Keep the details private until we have agreed a disclosure date.
Safe harbour
If you act in good faith and follow these rules, we will treat your research as authorised. We will not take legal action against you or report you to the authorities for it, and if someone else does, we will make it clear that you acted with our permission. This does not cover actions that break the law in ways these rules cannot authorise.
Disclosure
We prefer to publish details after a fix is available to everyone who needs it. We will agree the timing with you, and we will not ask you to stay silent for longer than it takes to protect our customers. If we disagree, we will tell you why.
If you are a customer
Report suspected incidents through the security contact in your agreement or through support inside Nexus, so we can follow your incident plan. For how we protect data and the rules we map, visit the trust centre.