Security & Responsible Testing

Reporting an Issue

Email [email protected]. A useful report describes what you found, the steps to reproduce it, and what an attacker could do with it. Please include the date and approximate time of any requests you sent, so we can match them to our logs.

If a report contains customer data, tell us that it does rather than attaching it. We will arrange a secure way to receive it.

Testing That Needs Authorization

Apex Rental Pro runs live workspaces for real rental and lawn-care businesses. Their calendars, customer lists and invoices are operational data, and their staff act on the emails we send. The following require our prior written authorization, because each one affects a real business rather than a test environment:

• Active or automated testing against any Apex Rental Pro system, including scanners and fuzzers.
• Creating accounts or workspaces by automated means, or in bulk.
• Changing credentials, email addresses, or account settings on any account you do not own.
• Triggering outbound email or text messages to addresses or numbers you do not control.
• Establishing persistence, or any access that continues after a single request.
• Accessing, downloading, modifying, or retaining data belonging to a customer of ours or of theirs.
• Testing that degrades availability, including load, stress, and denial-of-service testing.
• Social engineering of our staff, our customers, or their staff.

Write to [email protected] describing the testing you have in mind. We are glad to set up scope and a window for legitimate research.

What You May Do Without Asking

You do not need permission to browse our public pages, read client-side JavaScript, passively observe request and response formats produced during ordinary use, or use an account you created and own as the product is intended to be used. This does not authorize vulnerability scanning, automation, attempts to bypass controls, or other active security testing. If something looks wrong, stop and tell us rather than confirming it by going further — a description of the flaw is enough for us to reproduce it ourselves.

Stop as soon as you have confirmed an issue exists. Continuing past that point — to see how much data you can reach, or how many accounts you can affect — is where good-faith research becomes an incident we have to respond to.

Disclosure

Please give us a reasonable opportunity to fix an issue before describing it publicly, and do not publish details of a vulnerability, or any data obtained through one, without our written agreement. We would rather coordinate a disclosure with you than read about it first elsewhere.

Rewards

We do not operate a bug bounty programme, and no payment is offered for a report in the absence of a written agreement signed in advance. That is not a comment on the value of the work — we simply want to be straightforward about it before you spend your time, rather than afterwards.

What to Expect From Us

We aim to acknowledge a report within five business days and to tell you what we intend to do about it. We will not pursue legal action over research conducted in good faith and within this policy, and we are happy to credit you when a fix ships if you would like us to.

This policy applies to systems Apex Rental Pro operates. It does not grant permission to test a customer’s own website, network, or third-party services that happen to be linked from a workspace.