Security
If you believe you found a security issue in Cexi or its public services, please report it privately so we can investigate and protect users.
Report privately
Email security@cexi.app. Do not include passwords, authentication tokens, private health records, or other sensitive user data in an initial report.
Report an issue
Use the security mailbox for suspected unauthorized access, account-isolation failures, authentication issues, exposure of health or training data, unsafe storage, or a vulnerability in the website or app. For ordinary bugs, use support instead.
What to include
- A short description of the issue and its potential impact.
- The affected product, page, endpoint, app version, and device or browser where relevant.
- Minimal reproduction steps or a safe proof of concept. Please stop before accessing another person’s data.
- Your preferred contact method and whether you want acknowledgement of the report.
Our process
Acknowledge
We aim to acknowledge complete reports within two business days.
Assess
We reproduce the issue, assess user impact, and restrict access or deploy a fix when appropriate.
Coordinate
For an active exposure, we may ask you to coordinate a disclosure timeline while remediation is underway.
Close
We will communicate the outcome when we can do so without exposing additional security details.
Cexi does not currently operate a bug-bounty program. Good-faith testing that avoids privacy violations, service disruption, and data access outside your own account is preferred.
Security boundaries
Cexi uses Apple Sign in with Apple for production authentication, Supabase for account data and sync, and first-party infrastructure for network AI features. Optional Apple Health data is permission-based. See the Privacy Policy and Privacy choices for data controls.
Never send credentials or private health information by email. If you accidentally disclose a secret, say so immediately and rotate it if possible.
Project operator
Cexi security contact
Security: security@cexi.app
Legal and privacy: legal@cexi.app · privacy@cexi.app
Cexi is the product name and cexi.app is the canonical service. The public Terms remain a counsel-review draft until the legal operator and jurisdiction are published.
Home · Methodology · Support · Status