Applifyer / Security & responsibility
Security is part of the work we deliver. Here is who is accountable, what we take responsibility for, and how we set the boundaries for testing our products and our clients’ systems.
Meet our security leadAccountability
Edi Hasaj leads security at Applifyer, LLC and is accountable for application and infrastructure security across Applifyer’s own products and the client work within our agreed scope. His responsibilities include security reviews, access decisions, vulnerability remediation, and coordinating the response to security reports and incidents with the relevant product or client owner.
Our commitments
For Applifyer-owned products, we are responsible for security decisions across application code, infrastructure, deployments, and ongoing maintenance. This includes reviewing security-sensitive changes, managing access and secrets, assessing vulnerabilities, and prioritizing remediation according to risk.
For client products, our security responsibilities follow the agreed engagement: the code we deliver, the systems we are authorized to manage, and the maintenance we are contracted to provide. We document security considerations, communicate identified risks, and coordinate fixes with the client’s designated owner. Clients retain control of their systems and approve access, testing, and production changes.
Our responsibility extends to the source code, credentials, and product or client data we handle during delivery and support. Access must be limited to the people and systems that need it for the agreed work. Sensitive information must be protected in investigation, reporting, and handover, and access must be removed when it is no longer required.
Rules of engagement
Security analysis and vulnerability validation must be limited to systems we own or are explicitly authorized to assess. Working on a client’s product does not grant blanket permission to test its infrastructure, users, or third-party services.
The security lead and the system owner must approve testing in writing before it begins. Client work also requires the client’s explicit authorization.
The written scope must identify the systems, permitted techniques, testing dates, data-handling requirements, stop conditions, and contacts. Changes require renewed approval.
Findings must be documented and shared privately with the responsible owner. Suspected incidents and critical risks must be escalated promptly, with remediation and validation coordinated with that owner.
Get in touch
Contact our security lead at edi.hasaj@applifyer.com. Include the affected product or URL, a description of the issue, and minimal steps to reproduce it. Please avoid sending passwords, tokens, or personal data; ask for a suitable way to share sensitive evidence.
This page provides a reporting contact and describes our security responsibilities. It does not authorize testing. Obtain written permission before carrying out any assessment.
Last updated: 29 October 2026 · Applifyer, LLC