Responsible disclosure policy

This policy covers the following, when used as intended:

• The BolderBrain web application at bolderbrain.com and its API endpoints.
• Authentication, session handling, and authorisation logic, including access between separate customer organisations.
• Handling of personal data submitted through assessments, 360 feedback, and development plans.

Out of scope: findings that require physical access to a device, social engineering of our staff or customers, denial-of-service or volumetric testing, spam or content-only reports, reports about third-party services we buy (Cloudflare, Razorpay, our database provider and similar), and automated scanner output submitted without a demonstrated impact.

Email [email protected] with: the affected URL or feature, the steps to reproduce, the impact you believe it has, and any proof-of-concept you can share. Test accounts are available on request if you need a second organisation to demonstrate an isolation issue.

Please do not include live customer data in a report. Use your own test data.

• We acknowledge every report within 3 working days.
• We give you an initial assessment, including whether we can reproduce the issue, within 10 working days.
• We keep you updated on remediation progress until the issue is closed, and tell you when a fix is deployed.
• We will credit you on this page, or keep your report anonymous, whichever you prefer.

We ask for 90 days from acknowledgement before public disclosure, so we can ship a fix and notify any affected customers. If a fix takes longer, we will say so and agree a revised date with you in writing. If we have not responded within 10 working days, you may treat the report as unacknowledged and disclose it.

If you make a good-faith effort to follow this policy, we will not pursue legal action or report you to law enforcement for that research, and we will say so publicly if asked. This does not authorise testing that damages data, degrades service for other customers, or accesses data belonging to anyone other than accounts you created for the test.

We do not currently run a paid bug bounty. We do not pay for reports, and we do not accept reports that are only the unedited output of an automated scanner. Being honest about that is more useful to you than a promise we would not keep.

Our contact details are published at /security.txt in the format described by RFC 9116, so security researchers and scanners can find them without reading this page.

The RFC specifies /.well-known/security.txt as the location. Our reverse proxy currently refuses every dot-path, so the document is served at /security.txt instead. The content is identical.