Trust
Security and responsible disclosure.
Draft policy. A verified contact address will be published before this policy is treated as active.
Scope
The APN public website, APN Verify, and APN-published artifacts and receipts.
Please do
- Report findings privately before public disclosure.
- Provide enough detail to reproduce the issue.
- Allow a reasonable window for remediation before publication.
Please do not
- Test against third-party systems, or against APN pilot participants.
- Access, modify or exfiltrate data that is not your own.
- Perform denial-of-service testing.
Reporting channel
Marked for confirmation. Use the contact page, purpose: Technical review, in the interim.