Security

Email security@apexbim.com with:

• Description of the vulnerability
• Steps to reproduce (proof of concept)
• Impact assessment (what could an attacker do?)
• Your name/handle (for credit, if you'd like)

• Acknowledge receipt within 48 hours
• Initial assessment + triage within 5 business days
• Remediation within 90 days of confirmation
• Credit in our changelog (if desired)

We will not pursue legal action against security researchers who:

• Report vulnerabilities in good faith
• Avoid disrupting service or accessing other users' data
• Do not publicly disclose until we've shipped a fix
• Provide us reasonable time to remediate (90 days)

• In scope: apex.heedfx.com and all subdomains
• In scope: API endpoints at /api/*
• Out of scope: third-party services (Flutterwave, Google OAuth, Garage S3)
• Out of scope: social engineering, physical attacks, DoS/DDoS

With your permission, we'll credit you in our changelog + Hall of Fame. We do not offer monetary bounties at this time.