What this site actually does.

Payments

Online checkout is paused. This site does not collect card numbers. Apex never holds coins or client funds. List prices are on the pricing page. Email hello@apexsatoshi.com to ask about a plan.

Connection

Production is served over HTTPS. Every response, including files under /_next/static and /_next/image, includes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Browsers apply that policy when the response is HTTPS. Pages also send X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a referrer policy of strict-origin-when-cross-origin, and a Content-Security-Policy. The server does not send X-Powered-By.

Scripts need a per-request nonce. strict-dynamic lets a nonce-approved script load further scripts. No third-party script host is listed. The browser may connect only to this origin. Frames are not allowed. Fonts are files shipped with the site. Inline styles remain allowed because the interface uses style attributes.

What can see what you type

No analytics, advertising pixel, or session-replay tool is loaded. The Bitcoin quote is fetched by this site's server from Coinbase and then shown here. Your browser does not call Coinbase. Online checkout is paused, so this site does not open a card form.

Accounts

An account uses two httpOnly cookies in this browser. apex-session is the sign-in session. It expires 30 days after sign-in and is deleted when you sign out. apex-accounts holds the account record, including a scrypt password hash. It lasts 30 days and stays after sign-out unless you clear site data. Neither cookie is stored as a server account, and neither follows you to another device. An expired session is rejected. New passwords must be 12 to 200 characters and must not be a common password. An existing password of at least 8 characters can still sign in.

Online checkout is paused. Signing in does not record a paid plan.

Report a vulnerability

Email hello@apexsatoshi.com. The same address is in /.well-known/security.txt.