Security & Vulnerability Disclosure

How to report

Email security@aperlock.com. If that bounces for any reason, use hello@aperlock.com and say the word “security” in the subject.

Useful things to include, none of them required: what you found, roughly how to reproduce it, and what you think the impact is. A rough report sent today is worth more to us than a polished one sent next month.

Machine-readable contact details are published at /.well-known/security.txt per RFC 9116.

What we commit to

We are a small company, so these are deliberately modest and we intend to meet them rather than to impress you with them.

• We will acknowledge your report within three business days.
• We will tell you whether we consider it a vulnerability, and why, within ten business days — including if the answer is no.
• We will keep you updated while we work on a fix, and tell you when it ships.
• We will credit you by name if you want that, and not if you do not.

We do not run a paid bug bounty. We are not going to pretend otherwise, and we would rather say so up front than have you find out after the work.

Good-faith research

If you are researching in good faith, following this policy, and acting to avoid harm to our customers or their data, we will not pursue legal action against you and we will not ask your employer to.

Good faith here means what it sounds like: stop when you have established that something is wrong rather than seeing how far it goes, do not access, modify or retain data that is not yours, do not degrade a service other people are relying on, and give us a reasonable chance to fix the issue before you publish.

Scope

In scope

• aperlock.com and its subdomains
• The Chronolith product, including the appliance, the agent, and the customer portal
• Anything else clearly operated by Aperlock LLC

Out of scope

• Denial of service, volumetric testing, or anything that degrades a service for other people
• Social engineering of our staff, our partners, or our customers
• Physical access attempts
• Third-party services we merely use — report those to the third party, though we are glad to know as well
• Customer deployments. Chronolith runs on our customers’ own hardware, inside their own networks. Those are their systems and not ours to authorise testing against. Please do not.

Reports we will probably close

Said plainly so nobody wastes an afternoon. Findings from an automated scanner with no demonstrated impact, missing headers with no exploitable consequence, version-disclosure banners, SPF/DMARC observations on domains that do not send mail, TLS configuration already covered by our published settings, and self-XSS.

If you think one of these does have real impact in our particular case, send it anyway and explain why. The list is a default, not a rule.

Aperlock LLC · Powder Springs, GA · Last updated 13 September 2026. This policy is a statement of how we intend to behave. It is not a contract and it does not alter the terms under which Chronolith is licensed.