Vulnerability reporting guidelines

Vulnerability rewards

Valid security vulnerabilities verified to be within Airnova’s scope are eligible for rewards of 5–1,000 USD.

Low risk

Limited scope, restrictive exploitation conditions and a small actual security impact.

High risk

Can cause unauthorized access, sensitive data exposure or bypass of important business permissions, with significant impact on users or operations.

Critical risk

Can enable control of core systems, widespread account takeover, large-scale sensitive data exposure or major financial risk, with broad scope or severe consequences.

The amount is assessed by actual impact, with no fixed amount for a single severity level. We consider scope, exploitability, required privileges and the impact on accounts, data or funds, then communicate the severity and reward amount by email.

Severity is based on validation, not solely on the vulnerability name or the reporter’s rating. Submitting a report does not itself establish a reward.

What we accept

We accept reproducible issues with a real security impact in products and services owned or operated by Airnova.

• Airnova’s official website and the APIs, account and payment interfaces we operate.
• Official Airnova iOS and Android apps.

Examples include broken access control, account takeover, sensitive data exposure, injection, cross-site scripting, and payment or order authorization flaws.

Report issues in third-party payment platforms, carriers, app stores or external purchase sites to their operators. Issues caused by Airnova’s integration are welcome here. Contact customer support for ordinary order, refund or connectivity issues.

What to include

1. A short title and affected website, endpoint or app version
2. Discovery time, test environment and prerequisites
3. Reproducible steps, expected behavior and actual result
4. Security impact and minimal evidence or redacted screenshots
5. A reply email and your preference for public acknowledgment

Do not send passwords, full access tokens, eSIM activation codes, payment credentials or other people’s personal data. If evidence cannot be safely redacted, send a summary first to arrange a suitable transfer method.

How reports are handled

1. Receive and clarify

   Communicate using your contact details and request information if needed.

2. Reproduce and assess

   Check ownership, reproduction conditions, scope and severity.

3. Remediate and verify

   Arrange remediation and communicate progress based on risk and validation.

4. Coordinate disclosure

   Coordinate publication after a fix or mitigation, with acknowledgment only by consent.

Timing depends on impact and reproducibility. This page does not promise fixed resolution deadlines.

Collaboration and disclosure

• Use only your own accounts or explicitly authorized test environments, with the minimum actions needed to demonstrate the issue.
• Avoid service disruption, data destruction, social engineering or bulk data collection. Stop further access if you encounter other people’s data.
• Coordinate a fix or mitigation with us before publishing exploitable details. This page does not grant additional access or testing permissions.