0 Critical Vulnerabilities

Security

Security is not a feature — it's our foundation. Explore our comprehensive security practices, audits, and bug bounty program.

FEATURES

Security Architecture

key_off

No Long-Lived Keys

Eliminate API key theft by removing static credentials entirely. Every request is cryptographically signed.

encrypted

Ed25519 Signatures

Industry-standard elliptic curve cryptography with hardware enclave support for key storage.

shield_lock

Zero Trust Architecture

Every request is verified independently. No session state means no session hijacking.

memory

Hardware Security

Validator nodes require HSM or TEE for key management. Private keys never leave secure enclaves.

bolt

Rate Limit Immune

Payment-based access control makes DDoS attacks economically infeasible.

visibility_off

Privacy Preserving

Zero-knowledge proofs for balance verification. Transaction details remain private.

AUDITS

Independent Security Audits

TB

Trail of Bits

Full Protocol Audit

December 2025

C: 0H: 0M: 2L: 5
Resolved
OZ

OpenZeppelin

Smart Contract Audit

November 2025

C: 0H: 1M: 3L: 4
Resolved
SP

Sigma Prime

Cryptographic Review

October 2025

C: 0H: 0M: 1L: 2
Resolved
BOUNTY

Bug Bounty Program

We reward security researchers who help keep Apiosk safe. Our program is managed through Immunefi and pays out up to $100,000 for critical vulnerabilities.

Critical

Remote code execution, fund theft

$100,000
High

Privilege escalation, data breach

$50,000
Medium

Logic errors, minor fund risk

$10,000
Low

Best practice violations

$1,000
SCOPE

In Scope

Core Protocol (apiosk-core)
Settlement Contracts (Ethereum, Solana)
Official SDKs (Node.js, Python, Go, Rust)
API Gateway Infrastructure
Validator Node Software
Third-party integrations
Frontend applications
Social engineering attacks
paymentsTotal Paid Out
$247,500

To 23 researchers since program launch

COMPLIANCE

Regulatory Compliance

verified

SOC 2 Type II

Certified
check_circle

GDPR

Compliant
pending

ISO 27001

In Progress
check_circle

CCPA

Compliant
security

Security Contact

For responsible disclosure of security vulnerabilities, please contact our security team directly.

PGP Key: 0x8A2B...F91C

Loading Protocol
APIOSK_TRANSITION_v1.0