Security

1. Report a vulnerability

If you believe you have found a security vulnerability in the DaVero AI website, email [email protected] with “Security report” in the subject line. Please include:

• the affected URL or component and the type of issue;
• step-by-step instructions to reproduce it, with any proof-of-concept code, requests or screenshots;
• the impact you believe it has;
• how we can reach you, and whether you would like to be credited.

We will acknowledge your report, investigate it, keep you informed of our progress and tell you when it is fixed. Please keep the details private until we confirm a fix, or until we agree a disclosure date with you.

Our contact details are also published in machine-readable form at /.well-known/security.txt.

2. Scope

In scope

• daveroai.com and its pages;
• the contact form and its endpoint, /api/contact.

Out of scope

• services run by third parties, including our hosting, email and bot-check providers; report those to the provider;
• denial-of-service testing, or sending high volumes of requests or contact form messages;
• social engineering, phishing or physical attacks against our people or premises;
• reports from automated scanners without a demonstrated, exploitable impact;
• missing best-practice settings with no demonstrated impact, such as absent headers on pages that hold no sensitive data.

3. Safe harbour

If you act in good faith and follow this policy, we will:

• consider your research authorised, and not take or support legal action against you for it;
• work with you to understand and resolve the issue quickly;
• credit you publicly for the finding if you wish, once it is fixed.

Good faith means that you:

• test only within the scope above and stop as soon as you have confirmed a vulnerability;
• do not access, modify, keep or share data that is not yours beyond what is needed to show the issue, and tell us if you encounter any;
• do not degrade the website or disrupt other people's use of it;
• do not demand payment or other benefit in exchange for disclosure.

This safe harbour covers only our own systems and claims we control; we cannot authorise testing of third-party services. If you are unsure whether something is allowed, ask us first.

4. No bug bounty

We do not run a bug bounty programme and do not offer payment for reports. We are grateful for responsible reports and will credit researchers who want it.

5. How the website is protected

• Encrypted connections. The website is served only over HTTPS, and browsers are told to keep using HTTPS for two years (HTTP Strict Transport Security).
• Browser security headers. A Content Security Policy limits where scripts, frames and other content can load from; the website cannot be embedded in other sites; content types are not guessed; referrer data is limited; and camera, microphone, location, payment and USB access are switched off.
• A hardened contact form. The endpoint accepts same-origin JSON requests only, caps request size at 10 KB, validates every field on the server, and rate-limits each IP address. Spam controls include a hidden field, a signed time check, content rules, a repeat-message check and, when enabled, Cloudflare Turnstile.
• Minimal data. The website has no accounts, no database, no analytics and no advertising tools. A contact form submission is sent as a plain-text email and not stored on the website. See our Privacy Policy.
• Secrets and dependencies. Keys are kept in the hosting environment, not in the code. Dependencies are checked with automated vulnerability audits.
• Security review. The website's code was reviewed for security in November 2026 and the issues found were fixed.

6. How we govern agent work

For client work, our governance approach is built on these practices:

• Human approval. Agents prepare the work; an authorised person on the client's side approves the result before the workflow proceeds.
• Least privilege. Each person and agent gets only the access its task needs, and preparation is separated from approval.
• Audit trail. Agent actions, human decisions and resulting changes are recorded so decisions can be reconstructed.
• Change control. Prompts, models, tools and workflow rules are versioned and tested, with a rollback path.
• Incident response. Defined steps to pause an agent, contain an issue, preserve evidence and notify the right people.
• Data boundaries. Agents are designed to run inside the client's platform, with collection limited to the task.

This approach is designed to align with the NIST AI Risk Management Framework, ISO/IEC 42001 and SOC 2 practices. We do not claim certification or attestation against any of them.

7. Contact

Security reports and questions: [email protected].