| 1234567891011121314151617181920212223242526272829 |
- # briven security disclosure policy
- # RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116
- Contact: mailto:security@flndrn.com
- Expires: 2027-05-21T00:00:00.000Z
- Preferred-Languages: en, nl, fr
- Canonical: https://briven.tech/.well-known/security.txt
- Policy: https://docs.briven.tech/trust
- Acknowledgments: https://docs.briven.tech/trust#acknowledgments
- # We commit to:
- # 1. acknowledging valid reports within 72 hours.
- # 2. patching critical vulnerabilities within 14 days of triage.
- # 3. publicly crediting researchers (opt-in) on docs.briven.tech/trust.
- #
- # In scope: briven.tech (managed platform), docs.briven.tech, api.briven.tech,
- # realtime.briven.tech, the briven-core open-source codebase
- # at code.konnos.org/flndrn/briven.
- #
- # Out of scope: third-party services we use (Polar, Mittera, Hostinger,
- # Cloudflare) — report those to the respective vendor.
- # Social-engineering attacks against staff or customers.
- # Physical-security tests of any briven-operated facility.
- #
- # Please do NOT:
- # - exfiltrate or modify other customers' data
- # - run automated scanners that meaningfully impact availability
- # - publicly disclose before we've had a chance to patch (14 days
- # for criticals, 90 days otherwise)
|
