Security and vulnerability reporting

Official reporting channel for Appro-app SRL, published in accordance with the European Cyber Resilience Act (Regulation (EU) 2024/2847). Reports sent here reach Matt Jacquet directly.

What this covers

Appro's own applications, this website, and ApproKernel, the clean-room governance toolkit Appro builds its agents on and publishes for others to use. If you are unsure whether something you found belongs here, report it anyway and we will redirect it if it does not.

How to report

Report to

matt@appro-app.com

Status

Active. Monitored directly by the author and maintainer.

Describe the issue, name the affected application or repository and its version, give the steps to reproduce it, and say what you think its impact is. A report that lets us reproduce the problem is worth more than one that only asserts it.

Please provide sufficient detail to reproduce the finding, but avoid sending destructive payloads, conducting denial-of-service tests, or accessing unauthorized customer data beyond what is needed to prove the issue.

What to expect

We commit to an initial substantive acknowledgement within 48 business hours, an initial severity assessment, updates while a repair is underway, and no requirement that you disclose your personal identity to be heard.

Coordinated disclosure

Please do not open a public issue, post the finding, or otherwise disclose it before we have had a reasonable chance to respond and release a fix. We do not offer a bounty. We do commit to not pursuing legal action against a researcher reporting in good faith, through this channel, who does not access, modify, or destroy user data.