Research
Vulnerabilities found and responsibly disclosed
Before anyone hires a security tester, they should know the tester can find what others miss. This is the public part of that record.
Brexa's researchers have found vulnerabilities and reported them through the official bug bounty or vulnerability disclosure programs of the companies below. Each report was made under that program's published rules, and details stay private unless the program allows them to be published.
Microsoft
Vercel
Epic Games
Snapchat
These companies are not Brexa customers and do not endorse Brexa. Logos are trademarks of their owners and are shown only to identify the programs the reports were made to.
Why this matters when you choose a tester
Large bug bounty programs are among the most heavily tested targets on the internet: thousands of researchers look at the same systems, and only new, reproducible, in-scope issues are accepted. Finding something there is a reasonable signal of skill. It is not a substitute for checking how a provider will treat your systems, which is why our guide on how to choose a penetration testing company lists other questions to ask.
How we disclose
- Only inside a program's published scope and rules, or with the owner's written permission.
- Reported privately to the owner first, with enough evidence to reproduce and fix.
- No data accessed beyond what is needed to demonstrate the issue, and none retained.
- Nothing published without the owner's agreement or the program's disclosure terms.
Read more in responsible disclosure and bug bounties. If you have found a vulnerability in Brexa itself, see our vulnerability disclosure policy.
Find out what an attacker could do with your systems.
Book a short scoping call. Nothing is tested until scope and rules of engagement are signed, and every finding comes with proof.