Home / Vulnerability Disclosure
apoQlar GmbH takes the security of its products and services seriously. We value the work of the security research community and welcome good-faith reports of vulnerabilities that help us protect our users, our hospital partners, and the patients they serve.
Please send vulnerability reports by email to security@apoqlar.com. To help us triage quickly, include where possible:
If you wish to send sensitive details encrypted, contact us first at security@apoqlar.com and we will share a public key.
This policy covers the websites and online services operated by apoQlar GmbH, including apoqlar.com and the HoloMedicine® web platform and portal. Third-party services we rely on (e.g. hosting, analytics) are governed by their own programs and policies.
We consider security research and vulnerability disclosure conducted in line with this policy to be authorized. We will not pursue or support legal action against researchers who act in good faith and adhere to the guidelines below. If legal action is initiated by a third party against you for activities conducted in accordance with this policy, we will make this authorization known.
When researching, please:
The following are generally not eligible unless a concrete, exploitable impact is demonstrated: reports generated solely by automated scanners; missing security headers or best-practice recommendations without a working proof of concept; rate-limiting or brute-force findings; clickjacking on pages without sensitive actions; and social-engineering attacks.
apoQlar does not currently operate a paid bug-bounty program. We sincerely appreciate every responsible disclosure and are glad to acknowledge researchers who help keep our users safe.
Security reports: security@apoqlar.com
Machine-readable details: /.well-known/security.txt