Skip to main content
Apprentice

Vulnerability Disclosure Program

Artists, shops, and clients trust us with their bookings, payments, and personal details. If you find a security problem, we want to hear about it.

Report a vulnerability

Last updated November 9, 2026

Rewards

Apprentice is a small, self-funded company. We don’t offer cash rewards for reports. What we do offer is a fast, honest response, credit on this page if you want it, and our real thanks.

How to report

Email support@useapprentice.com with “Security report” in the subject line. Please include:

  • What the issue is and where you found it (URL, screen, or API endpoint)
  • Steps to reproduce it
  • What an attacker could do with it
  • Screenshots, video, or a proof of concept if you have one
  • How you’d like to be credited, if at all

In scope

  • useapprentice.com and its subdomains
  • The Apprentice iOS app
  • The Apprentice Android app
  • Public booking pages and studio pages hosted by Apprentice

Out of scope

  • Third-party services we use (payment processors, email providers, hosting). Report those to the vendor.
  • Denial-of-service or load testing
  • Social engineering, phishing, or physical attacks on our team or customers
  • Spam or rate-limit issues with no security impact
  • Missing headers, cookie flags, or TLS settings with no working exploit
  • Reports from automated scanners with no proof of impact
  • Clickjacking on pages with no sensitive actions

Rules of engagement

  • Only test against accounts you own or have permission to use.
  • Do not view, change, or delete data that belongs to other users. If you reach someone else’s data by accident, stop and tell us.
  • Do not degrade the service for artists, shops, or clients.
  • Give us a reasonable amount of time to fix the issue before you share it publicly. We ask for 90 days.
  • Do not ask for payment in exchange for a report.

Safe harbor

If you follow this policy in good faith, we will treat your research as authorized. We won’t take legal action against you or ask anyone else to. If a third party takes legal action over research you did under this policy, we will make it clear that you acted with our permission.

What happens next

  1. We confirm receipt

    You’ll hear back within 3 business days.

  2. We check and rank it

    We reproduce the issue and tell you how serious we think it is.

  3. We fix it

    We keep you posted while we work on it, and tell you when it’s fixed.

  4. We say thanks

    With your permission, we credit you on this page.

Thanks

No public credits yet. Researchers who report valid issues and want credit will be listed here.