Security Policy
This policy explains how to report a potential Aprexx vulnerability confidentially and how we coordinate its assessment.
Last updated: 31 August 2026
Supported versions
We accept reports concerning the latest version distributed through Aprexx official channels. Where an order provides support for another version, the period specified in that agreement applies.
Report a vulnerability
Send your finding privately to the following point of contact:
[email protected]Professional address: Calle Cidro, 3, 28044 Madrid, España
Where possible, include:
- The affected Aprexx version and operating system.
- A description of the issue and its potential impact.
- The minimum steps required to reproduce it.
- A contact method for coordinating follow-up.
Do not include customer documents, credentials, or personal data. Use fictional examples or anonymised evidence.
Coordinated disclosure
Please keep the finding confidential and avoid public disclosure while we investigate the issue and coordinate a correction.
Nereodata will acknowledge receipt, assess the impact, and communicate any appropriate corrective or mitigating measures. Where necessary, it will also inform affected users.
Good-faith research
If you act in good faith, remain within the scope of this policy, limit testing to what is strictly necessary, avoid harm, disruption and access to third-party data, and report the finding confidentially, Nereodata will not initiate or support legal action arising from that research.
This protection applies only to systems and products controlled by Nereodata. It does not bind third parties or competent authorities.
Denial-of-service testing, social engineering, persistence, lateral movement, alteration or deletion of data, and extraction of customer information are not authorised. If you accidentally access sensitive information, stop testing and report it.
This policy does not constitute a bug bounty programme. We do not offer monetary compensation unless expressly agreed in advance.
Exchanging sensitive information
Before sending exploit code, sensitive attachments, or details that could facilitate abuse, request a secure exchange method by email.
Security advisories
When a fixed vulnerability requires public communication, we will publish a stable advisory identified as APX-SA-YYYY-NNN, including affected versions, severity, status, the fixed version or mitigation, and relevant dates.
View advisories via RSS