Affected surface
Name the app version, website route, API endpoint, feature, network, and device or browser environment where the issue appears.
Security disclosure
Report vulnerabilities privately. Verify claims publicly.
Use security@aperturex.io for responsible disclosure. Do not send wallet credentials, private user data, or exploit details through public channels.
Emailsecurity@aperturex.io
security.txtcanonical disclosure metadata
Private firstprotect users while a report is reviewed
No secretsnever include wallet credentials
What to include in a useful report
Provide enough sanitized evidence to reproduce the issue without exposing a real user or wallet.
Reproduction steps
Describe the smallest reliable sequence that produces the behavior, including prerequisites and whether a clean test wallet was used.
Security impact
Explain what an attacker could read, modify, authorize, bypass, or deny—and which assumptions or user actions are required.
Sanitized evidence
Use test-only addresses and redact tokens, account identifiers, headers, and personal data. Never attach a recovery phrase, private key, passphrase, app passcode, backup password, or encryption key.
Safe contact
Include a way to reach you and any disclosure timeline constraints. Do not post unresolved exploit details publicly before the team has a reasonable chance to assess them.
Scope honesty
A report does not automatically imply eligibility for payment. Reward terms exist only when an explicit program, scope, and conditions are published by Aperture.
Canonical security resources
Use these first-party sources to distinguish Aperture’s current claims from third-party summaries or outdated pages.
- security.txt — machine-readable disclosure contact and policy metadata.
- Security — the user-facing product security explanation.
- Security model JSON — structured custody, storage, network-boundary, and agent-safety facts.
- Security reviews and audits — the registry for any published independent review evidence.
- Source repository — public source for technical inspection.
Urgent active exploitation: put “URGENT SECURITY” in the email subject, describe the affected version and impact, and withhold public details that would increase user risk.
Continue with first-party detail
Go deeper with the product pages, Journal explainers, and machine-readable sources that support this page.
Self-custody is clearest when the rules are visible.
Download Aperture from the official App Store listing, verify the product identity, and understand your recovery method before moving funds.