The APEX team takes the security and integrity of our open-source software seriously. This document outlines our vulnerability reporting process, supported versions, and commitment to responsible disclosure.

Security updates and patches are actively maintained for the following versions:

If you discover a potential security vulnerability in APEX, please do not report it via a public GitHub issue or pull request. Public disclosure before a fix is available puts our users and downstream deployments at risk.

1. GitHub Private Vulnerability Advisory: Submit your report privately through GitHub Security Advisories.
2. Email Disclosure: Alternatively, email the maintainer directly at pavanbadempet@gmail.com with the subject line [SECURITY VULNERABILITY] APEX - <Short Summary>.

To help us investigate and reproduce the issue rapidly, please provide:

• Type of vulnerability (e.g., SQL Injection, Remote Code Execution, Authentication Bypass, Secret Leak, Denial of Service).
• Affected component(s) (e.g., FastAPI gateway, Rust SIMD core, Docker Compose environment, Databricks ETL scripts).
• Step-by-step reproduction instructions or a minimal Proof of Concept (PoC).
• Potential impact and exploitation scenarios.
• Any suggested remediation or patches (if available).

Our maintainers adhere to the following response timeline:

• Initial Acknowledgment: Within 48 hours of report receipt.
• Triage & Assessment: Within 5 business days, confirming severity and scope.
• Fix & Patch Development: A fix will be developed in a private security branch and verified with targeted regression tests.
• Public Disclosure & Release: Coordinated disclosure within 30 days of initial confirmation, or earlier if mutually agreed.

When running APEX in production:

1. Never commit .env files, secrets, or API keys to version control.
2. Rotate JWT secret keys and database passwords periodically.
3. Run non-root Docker containers as specified in the production Dockerfile.
4. Use TLS/HTTPS on public-facing FastAPI and frontend endpoints.
5. Enable differential privacy (backend/data/privacy_budget.json) when exporting user interaction logs.

We believe in acknowledging security researchers who help protect the community through responsible disclosure. Researchers who report verified vulnerabilities will be credited in our release notes and Security Hall of Fame (unless anonymity is requested).