Vulnerability disclosure policy

We find vulnerabilities for a living, so we take reports about our own systems seriously. If you believe you have found a security issue in Brexa, please tell us. This policy is also published in machine-readable form at /.well-known/security.txt (RFC 9116).

How to report

• Email assessment@trybrexa.com with the subject “Security report”.
• Include the affected URL or component, the steps to reproduce, the impact you observed, and how to reach you.
• Please do not include other people's personal data. If you encountered any, tell us what it was and delete it.

In scope

• The website at trybrexa.com and www.trybrexa.com.
• The Brexa client portal and staff console (authentication, authorization, session handling, data isolation between organizations).

Out of scope

• Denial of service, load testing, spam or social engineering of Brexa staff or clients.
• Physical attacks, and third-party services we use (report those to their owners).
• Missing best-practice headers or banners with no demonstrated security impact.
• Accessing, modifying or keeping data that belongs to Brexa clients. Stop at the minimum needed to show the issue.

What you can expect from us

• An acknowledgement of your report, and updates while we investigate and fix it.
• Credit, if you want it, once the issue is fixed.
• No legal action against you for research done in good faith under this policy: staying in scope, avoiding harm and privacy violations, and giving us reasonable time to fix before any disclosure.

Brexa does not currently run a paid bug bounty. To understand how disclosure programs work in general, read responsible disclosure and bug bounties.