SECURITY POLICY

Security & disclosure

Q: How do I report a security vulnerability in AeroScope?

Email muhammaduzairr69@gmail.com with SECURITY in the subject line, or use the contact form, before any public disclosure. A machine-readable policy is published at /.well-known/security.txt. We aim to acknowledge within 72 hours.

How to report a vulnerability, the controls actually in place, and exactly what data the platform holds. Only verifiable controls are listed.

Reporting

Report a vulnerability

If you believe you have found a security issue in AeroScope, please report it privately before any public disclosure. Email [email protected] with "SECURITY" in the subject line, or use the contact form.

A machine-readable policy is published at /.well-known/security.txt.

Acknowledgement	We aim to acknowledge reports within 72 hours. AeroScope is maintained by one person, so we state that as a target, not a contractual guarantee.
Safe harbour	Good-faith research that respects user privacy, avoids service degradation and does not access data beyond your own account will not be pursued.
Out of scope	Denial-of-service, volumetric or automated scanning, social engineering, and issues in third-party upstream feeds we do not control.
Bounty	No paid bounty programme. Credit is given in the changelog where a reporter wishes.

Verified posture

Controls actually in place

Every item below is verifiable from the live response headers or observable behaviour of the service. We deliberately do not list controls we have not implemented.

Area	Control
Transport	HTTPS only. HSTS enabled with `max-age=31536000; includeSubDomains` (one year).
Response headers	`X-Content-Type-Options: nosniff`, `X-Frame-Options: SAMEORIGIN`, `Referrer-Policy: no-referrer`, set via Helmet and the reverse proxy.
Authentication	Signed JWT session tokens with expiry. Account passwords are hashed with bcrypt; plaintext passwords are never stored.
Abuse control	Rate limiting applied to authentication and other sensitive endpoints; a windowed limiter rejects excessive attempts per client.
Edge	Traffic is fronted by a CDN/WAF layer providing TLS termination and network-level filtering.
Isolation	The analysis/ML service runs as a separate process with its own memory ceiling, so a fault there cannot take down the public API.

Data handling

What we hold, and what we do not

AeroScope analyses publicly broadcast aircraft telemetry. It is not a people-tracking product, and the data it ingests is transmitted openly by aircraft on 1090 MHz and republished by volunteer networks.

Aircraft data: public ADS-B broadcasts (identity, position, velocity, integrity fields). No proprietary, classified or restricted feeds are used.
Observer location: the point you choose is used to compute what is overhead. It is your input, not a device-tracked position.
Accounts: where an account exists, an email address and a bcrypt password hash. See the privacy policy.
No sale of data. We do not sell or broker user data.

For the capability-token model used by the API, see the zero-trust API design; for what the platform cannot see, see limitations.

FAQ

Frequently asked questions

How do I report a security vulnerability in AeroScope?

Email [email protected] with SECURITY in the subject line, or use the contact form, before any public disclosure. A machine-readable policy is published at /.well-known/security.txt. We aim to acknowledge within 72 hours.

Is AeroScope SOC 2 or ISO 27001 certified?

No. AeroScope holds no formal security certifications and does not claim any. The security page lists only controls that are verifiable from the live service, such as HSTS, security response headers, bcrypt password hashing, signed session tokens and rate limiting.

What personal data does AeroScope store?

Aircraft data is public ADS-B telemetry, not personal data. Where an account exists we store an email address and a bcrypt password hash. The observer location is a point you choose, not a tracked device position. We do not sell user data.