Security
If you believe you have found a security vulnerability in Brandeno, please tell us privately before telling anyone else. Write to security@bridivo.com (or support@bridivo.com). The same contact is published in /.well-known/security.txt. Reports in English or Arabic are welcome.
What to include
- What is affected (the address or feature) and how to reproduce the problem.
- The impact you observed. Use test data only, never another customer's account or content.
- How we can reach you, if you want to be told when the fix is live or credited.
What we do
We acknowledge a report within 3 business days and send a first assessment within 10 business days. Confirmed problems are fixed through our ordinary release process; critical issues are targeted within 7 days, high within 30 and medium within 90. We tell you when the fix is live. Reports that concern a supplier (for example a social network, the payment provider or a hosting provider) are forwarded to that supplier's own programme. There is no bounty programme at this time.
Scope
In scope are the Brandeno web workspace and API, the public API and MCP endpoint, and the isolation of data between organizations and brands. Out of scope are the social networks and other suppliers themselves, and denial-of-service or volume testing.
Good-faith research
Good-faith research that respects this policy, avoids privacy violations and service disruption, and gives us reasonable time to fix the problem before disclosure will not be pursued. This wording stands until the professional legal review changes it.