Responsible reporting

Found a potential security issue? Stop safely and tell us.

Use only accounts, records, and permissions you are authorized to access. Do not continue once another person's data, a consequential action, or service impact could be involved. Send the smallest sanitized evidence needed to explain what you observed.

Published 2026-07-22 · official intake: support@aptoria.ai

Aptoria

Responsible reporting

Evidence checklist

5

Stop conditions

4

Account compromise or active harm

Public-program boundary

What helps us understand the report

Evidence checklist

1

Affected Aptoria URL or product area and the account role you were using

2

A concise description of the issue and the security impact you observed

3

Minimal reproduction steps using only accounts and records you are authorized to access

4

Approximate date, time, and timezone of the observation

5

Sanitized screenshots, request IDs, or log excerpts with secrets and personal data removed

Responsible reporting

Published

2026-07-22

official intake

support@aptoria.ai

Evidence checklist

Stop conditions

Account compromise or active harm

If you suspect an account is compromised, stop research activity, preserve the time and request details, change affected credentials through the official application, revoke sessions or provider access where available, and contact support. Contact the relevant bank, payment, screening, email, or identity provider directly when its account or credentials may be involved. For immediate danger, contact local emergency services first.

Do not keep testing when harm could begin

You encounter tenant, applicant, owner, vendor, employee, or customer data that is not yours

Testing could change records, move money, send communications, create access, or interrupt service

The next step would require credential theft, social engineering, phishing, physical access, or denial of service

The evidence contains passwords, session tokens, payment credentials, screening reports, government identifiers, or unredacted personal data

Evidence checklist

What helps us understand the report

Affected Aptoria URL or product area and the account role you were using

A concise description of the issue and the security impact you observed

Minimal reproduction steps using only accounts and records you are authorized to access

Approximate date, time, and timezone of the observation

Sanitized screenshots, request IDs, or log excerpts with secrets and personal data removed

Stop conditions

Do not keep testing when harm could begin

You encounter tenant, applicant, owner, vendor, employee, or customer data that is not yours

Testing could change records, move money, send communications, create access, or interrupt service

The next step would require credential theft, social engineering, phishing, physical access, or denial of service

The evidence contains passwords, session tokens, payment credentials, screening reports, government identifiers, or unredacted personal data

Account compromise or active harm

If you suspect an account is compromised, stop research activity, preserve the time and request details, change affected credentials through the official application, revoke sessions or provider access where available, and contact support. Contact the relevant bank, payment, screening, email, or identity provider directly when its account or credentials may be involved. For immediate danger, contact local emergency services first.

Public-program boundary

This page does not authorize scanning, exploitation, access to third-party data, service disruption, social engineering, or violation of law or provider terms. It does not publish a bug bounty, reward, safe-harbor commitment, acceptance promise, remediation deadline, or response-time SLA. Aptoria may request more information and will handle reports according to available scope and severity.