Security & independent review
If you found a problem, tell us. If you want to look for one, we will help. Nobody outside our lab has reviewed APEX-256 yet.
Report a vulnerability
Email security@apex256.com. Encrypt it if you like. Our public key is here.
Key fingerprint: 0DA3 BE4A F323 C39B F517 AC2E 48D2 978D DAD9 D673
The machine-readable version is at /.well-known/security.txt. We will acknowledge your report and keep you in the loop.
Independent review: none yet
No outside party has published an attack on APEX-256 or a review of it. Everything on the Validation page was run by us.
That is a gap, and we would like it filled. Academic reviewers get the evaluation kit at no cost under NDA: the math write-up, the 16-wave / 38-tool formal verification scripts (Z3, Bitwuzla, cvc5, CaDiCaL, Coq, F*, HiGHS), and the test vector generators.
Try to break it
Scope: the cipher, its initialization, and the way the reference implementation uses them. If you break something, or just find a property that looks wrong, tell us. With your permission, we will credit you.
We aren’t offering a payout yet. We are offering a straight answer and a fix if there is one.