Responsible Disclosure

Our commitment

Brixhaul takes the security of our systems and our clients’ data seriously. We welcome reports from security researchers who discover a genuine vulnerability and disclose it to us responsibly.

Scope

This policy covers this public website and other Brixhaul-owned systems that we confirm are in scope when you contact us. It does not cover third-party platforms, products, or infrastructure operated by our partners or the wider group unless we tell you otherwise.

How to report a vulnerability

Contact us through our Contact page and select "Other" as the area of interest, with a clear description of the issue in your message. We will follow up with a secure channel for any further technical detail.

Please include the steps needed to reproduce the issue, the potential impact as you understand it, and any supporting evidence such as a request or response sample. Please avoid including sensitive personal data in your initial report.

What we ask you not to do

Do not access, modify or delete data that is not your own, do not run tests that could degrade or disrupt our services, and do not publicly disclose a vulnerability before we have had a reasonable opportunity to address it.

What you can expect from us

We will acknowledge a genuine report, work to understand and reproduce the issue, keep you informed of our progress, and let you know once it has been addressed. We do not currently operate a paid bug bounty programme, but we are glad to credit researchers who report responsibly, if they would like us to.

Safe harbour

We will not pursue legal action against researchers who make a good faith effort to follow this policy, report issues privately, and avoid harming our systems, users or data.