Security Policy — ApexQuant

Reporting a Vulnerability

If you discover a security vulnerability in ApexQuant, please report it responsibly using our security report form. We take all reports seriously and will investigate promptly.

Please do not disclose the vulnerability publicly until we have had a reasonable opportunity to address it.

Submit Security Report →

What to Include

Affected component — website, dashboard, bot, license server, or other
Severity assessment — your assessment of the impact (Critical / High / Medium / Low)
Reproduction steps — clear, numbered steps to reproduce the issue
Proof of concept — screenshots, logs, or code demonstrating the vulnerability
Impact — what an attacker could achieve by exploiting this
Your contact information — so we can respond and credit you

The more detail you provide, the faster we can verify and fix the issue.

Response Timeline

Acknowledgement: within 72 hours of receiving your report

Initial assessment: within 7 days — we will confirm the issue and estimate severity

Fix & disclosure: coordinated with the reporter — we aim to patch critical issues within 30 days and will agree on a public disclosure date with you

We will keep you informed throughout the process. If you do not receive an acknowledgement within 72 hours, please follow up — your report may not have been received.

Scope

The following assets are in scope for security research:

The ApexQuant website — apexquant.tech and all public pages
The ApexQuant customer dashboard — authenticated customer interface
License validation infrastructure — backend systems for license issuance and verification
The ApexQuant bot software — Python-based trading bot (self-hosted by customers on their own VPS)

The following are out of scope:

Third-party services we rely on such as: Binance, Telegram, FRED (St. Louis Fed), TradingView, Anthropic, OpenAI, Google Gemini, Cloudflare, Stripe
Customers' own VPS instances or server configurations
Social engineering attacks against ApexQuant staff
Denial-of-service attacks
Issues requiring physical access to infrastructure

Safe Harbor

We consider good-faith security research to be a valuable contribution. If you conduct research in accordance with this policy, we will:

Not pursue or support legal action against you related to your research
Work with you to understand and resolve the issue quickly
Publicly acknowledge your contribution if you wish (with your permission)

Good-faith research means: you do not access, modify, or delete data belonging to other users; you do not disrupt our services; and you stop testing and report immediately upon finding a vulnerability.

Recognition

We do not currently offer a paid bug bounty program. We do offer public recognition (with your permission) in our security acknowledgements for valid, responsibly disclosed vulnerabilities.