Responsible Disclosure.
How to report a security vulnerability in Brandefense systems, and what to expect when you do.
Security researchers help keep our customers safe. If you find a vulnerability in a Brandefense system, we want to hear about it. This page says what you may test, how to report and what to expect from us. Please read it before you start testing.
Scope.
This policy covers systems that Brandefense owns and runs.
- The brandefense.io website and the subdomains that Brandefense owns and operates
- The Brandefense platform web application and its API
- Other applications and services that Brandefense owns and runs
- Systems owned by customers, partners or other third parties, even if they link to us
- Third-party services that we use but do not operate
- Denial-of-service and load testing
- Social engineering, phishing or physical attacks against staff, customers or partners
- Spam, and reports from automated scanners with no demonstrated impact
- Missing security headers or best-practice settings with no proven security impact
- Reports that depend on outdated or unsupported browsers
Testing Rules.
Keep your testing small and safe.
- Test only with accounts and data that you own or have permission to use
- Use the least access needed to show the problem
- Stop testing and report as soon as you confirm a vulnerability
- Keep the details private until we have agreed on disclosure
- Access, change, copy or delete data that is not yours, beyond the minimum needed as proof
- Run denial-of-service tests
- Use social engineering against our staff, customers or partners
- Move on to other systems after you gain access
- Install malware or leave persistent access behind
- Share what you find publicly before we have had time to fix it
How To Report.
- Write to us
Email info@brandefense.io. Put "Security report" in the subject line.
- We acknowledge it
We aim to acknowledge your report promptly. We may ask you for more detail.
- We investigate and fix
We confirm the issue, work on a fix and keep you updated where we can.
- We agree on disclosure
Once the issue is fixed, we agree with you when and how details can be shared.
What To Include And What To Expect.
- A short description of the problem and its likely impact
- Where you found it, such as an address, an application or a product
- The steps needed to see it again
- A proof of concept, screenshots or logs, kept to the minimum needed
- How we can reach you
- Whether you plan to publish, and when
- We aim to acknowledge your report promptly.
- We read the report and look at what you describe.
- We treat your report and your contact details as confidential.
- We keep you updated on progress where we can.
- This policy does not promise payment or a reward.
We appreciate good-faith research and will work with you. Please follow the rules on this page, stay within the scope, and ask us first if you are unsure whether an action is allowed. This page does not cover third-party systems, and it does not offer payment or a bug bounty.
We ask you to give us reasonable time to fix a problem before you share details with anyone else. We will work with you to agree a date for public disclosure. We may publish an advisory when a fix is released. We credit reporters by name if they ask us to, and we do not name you without your consent.
Where To Send A Report.
Email info@brandefense.io with the subject line "Security report". Include the details listed above. Please send only the data needed to show the problem.
Know What Is Exposed. Before Attackers Do.
Book a demo of the platform.
- 4.7Gartner Peer Insights
- 24hEarly warning time
- 190+Countries covered
What you see in the demo
- Your exposureAssets and services seen from the outside, starting from your own domain.
- Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
- From alert to actionHow findings reach your team and what to do next.