Security
Found a weakness? Tell us.
We sell security work, so we hold our own site to the same standard. If you find a vulnerability, we want to hear about it, and we will not pursue anyone who reports in good faith.
Last updated 27 October 2026
How to report
Use the contact form and choose "Data protection or cybersecurity". Put "Security report" at the start of your message. Our machine-readable contact details are in/.well-known/security.txt.
Please include:
- the page or address affected;
- what the weakness is and what an attacker could do with it;
- the steps to reproduce it;
- how you would like to be credited, if at all.
What happens next
- We acknowledge your report within five working days.
- We tell you whether we can reproduce it and what we plan to do.
- We fix confirmed issues as fast as their severity requires, and tell you when it is done.
- With your permission, we credit you on this page once the fix is live.
In scope
- This website and its contact form.
Out of scope
- Denial of service or load testing.
- Social engineering, phishing or physical attacks on AIT staff or offices.
- Reports from automated scanners with no demonstrated impact.
- Systems we run for clients. Those belong to the client; report to them.
Good faith
If you act in good faith, avoid harming people or data, do not access more data than you need to show the problem, and give us reasonable time to fix it before you publish, we will not take legal action against you. We do not run a paid bug bounty.