Security
Security & responsible disclosure
How we protect apxlbs.com and the systems we build, and how to report a vulnerability.
How we protect the site
We take the security of apxlbs.com and the systems we build for clients seriously. The site enforces strict HTTP security headers, a content security policy, HSTS, and isolated iframe sandboxing on demo embeds.
- All traffic over TLS 1.2+; sessions are HttpOnly, Secure, SameSite cookies.
- Admin access requires two-factor authentication; two-factor secrets are encrypted at rest.
Reporting a vulnerability
If you've found a security issue on apxlbs.com or in any system APXLBS has built, email rodrigo@apxlbs.com with the subject line Security Report. Please don't publish the issue until we've had a reasonable opportunity to fix it. Machine-readable contact details are in security.txt.
What we commit to
- Acknowledge your report within 48 hours.
- Work with you in good faith on remediation.
- Credit you publicly, if you'd like.
What we ask of you
Act in good faith, avoid privacy violations, never destroy data, and stop testing as soon as you've confirmed an issue.
Questions
A person reads every message. Privacy requests are acknowledged within 5 business days.