Security
Responsible disclosure policy
If you find a security issue in ApexAI or this website, please tell us first, so we can fix it before it is used against anyone.
Draft. Bracketed items must be completed, and the policy reviewed by counsel, before publication.
Scope
The ApexAI product as released by [Company legal name], and this website at [domain]. [Other assets in or out of scope.]
How to report
E-mail [security]@[domain]. To encrypt sensitive details, use our key: [PGP key URL and fingerprint].
Include the affected version or URL, the steps to reproduce, the impact you observed and how to reach you.
What we commit to
We acknowledge your report within [N] business days and send an initial assessment within [N] business days.
We keep you informed while we fix the issue, and agree a disclosure date with you. Our default window is [N] days.
If you wish, we credit you when we publish the fix.
Research in good faith
Do not access, change or delete data that is not yours; if you reach someone else’s data, stop and tell us.
Do not run denial-of-service tests, social engineering or physical attacks.
We will not pursue action against research done in good faith under this policy. [Safe-harbour wording — counsel review.]
Rewards
[Bug bounty programme — status to be confirmed.]
security.txt
The same contact details are published in machine-readable form (RFC 9116). Its values are placeholders until go-live.