Keeping our customers' data safe is a top priority at Appcircle. If you believe you have found a security vulnerability in an Appcircle service, we encourage you to report it to us privately. We review every report we receive.
How to report
- Email your report to security@appcircle.io. Please do not use support tickets or public channels.
- Include a clear title, the affected service or URL, a description of the vulnerability and its impact, and step-by-step reproduction instructions or a proof of concept.
- Send each vulnerability in a separate email.
- Reports containing only automated scanner output are not accepted.
Scope
Any exploitable vulnerability that can compromise the integrity of customer data, disclose sensitive information or disrupt the service on the Appcircle cloud platform (my.appcircle.io and its APIs), for example:
- Remote code execution
- SQL or other injection
- Authentication or authorization bypass, including cross-organization data access
- Cross-site scripting (XSS) and cross-site request forgery (CSRF)
- Exposure of sensitive data such as credentials, signing keys or certificates
Out of scope
- Self-hosted Appcircle installations and the marketing website
- Vulnerabilities in third-party services or software we use
- Missing security headers (HSTS, CSP, X-Frame-Options and similar)
- Missing cookie flags, autocomplete settings or mixed content
- Self-XSS, logout CSRF and CSRF on anonymous forms
- Username or email enumeration, verbose error messages and software version disclosure
- Missing rate limiting or brute force without a demonstrated impact
- Social engineering, phishing and physical attacks
- Denial of service attacks
Rules
- Test only against accounts and data you own. Do not access, modify or delete other users' data.
- Do not degrade the service or run high-volume automated scans.
- Do not disclose the issue publicly or to any third party without our written permission.
We will not take legal action against researchers who follow these rules and act in good faith.
How we prioritize reports
Every valid report is scored with the CVSS v3.1 base score, based on the impact the report demonstrates on the Appcircle cloud platform, not on theoretical impact. We act on reports in order of their CVSS score: the higher the score, the sooner the issue is fixed.
Rewards
Appcircle does not offer monetary or merchandise rewards for vulnerability reports. To thank researchers, we list Critical findings in our Hall of Fame. Appcircle decides the final severity of each report and which findings are listed. Duplicate reports are not listed.
Hall of Fame
We thank the following researchers for responsibly disclosing Critical security issues to us. Only Critical findings are listed, after the issue is fixed and with the researcher's permission.
- MD. RAISUL ALAM RATUL (October 2026)
- Tegar Andriansyah (October 2026)
- Muhib Saleem (imwdev) (October 2026)