Reporting security vulnerabilities

Email security@avor.med, in English or German. Helpful details are:

• the affected address or component,
• a description of the vulnerability and its possible impact,
• the steps we need to reproduce it, and a proof of concept if you have one,
• how we can reach you with questions.

Please do not include other people's personal data. If you need an encrypted channel, say so in your first message and we will set one up.

These rules cover avor.med and all its subdomains, in particular the AVOR Assistant at app.avor.med. Please report vulnerabilities in third-party software or services we use directly to their vendor. A misconfiguration on our side belongs here.

• We acknowledge your report within three working days.
• We assess it, rate its severity with CVSS and keep you informed.
• Our targets for fixing a confirmed vulnerability, counted from confirmation: critical 7 days, high 30 days, medium and low 90 days. These are targets, not guarantees.
• We do not pay bounties.

• No tests that disrupt the service, so no denial-of-service attacks, load tests or mass scans.
• Do not access, change or delete other people's data. Go only as far as needed to demonstrate the issue, and do not keep or share data you come across.
• No social engineering or phishing against our team, our users or our partners.
• Use only accounts that are your own.

Please publish details only once the vulnerability is fixed or 90 days after your report, whichever comes first. We are happy to agree on a different date with you.

If you act in good faith and follow these rules, we will not take legal action against you: no criminal complaint, no request for prosecution, no lawsuit. We cannot rule out investigations that authorities open on their own.

Last updated: October 2026