konnosDashboard
page.tsx170 lines · main
1import Link from 'next/link';
2
3import { DocsShell } from '../../components/shell';
4
5export const metadata = { title: 'trust + security' };
6
7export default function TrustPage() {
8 return (
9 <DocsShell>
10 <h1 className="font-mono text-2xl tracking-tight">trust + security</h1>
11 <p className="mt-2 font-mono text-sm text-[var(--color-text-muted)]">
12 how to report a vulnerability, what&apos;s in scope, and the commitments we make to
13 security researchers who report in good faith. briven is open-core — the engine lives in
14 a public repo — so we expect (and welcome) scrutiny.
15 </p>
16
17 <Section title="reporting a vulnerability">
18 <p>
19 report security issues through{' '}
20 <Link
21 href="https://briven.tech/contact?topic=security"
22 className="text-[var(--color-text-link)] underline-offset-2 hover:underline"
23 >
24 the security topic on our contact form
25 </Link>
26 . it routes straight to the maintainer — please don&apos;t open a public GitHub issue
27 for anything exploitable, and don&apos;t post it on social media before we&apos;ve had a
28 chance to fix it.
29 </p>
30 <p>a useful report includes:</p>
31 <ul className="list-disc pl-5">
32 <li>the affected surface (URL, endpoint, package, or repo path) and the version / build sha</li>
33 <li>a clear description of the issue and its impact</li>
34 <li>reproduction steps — a minimal proof-of-concept beats a long writeup</li>
35 <li>any logs or screenshots, with secrets and real personal data redacted</li>
36 </ul>
37 <p>
38 a <strong>PGP key is available on request</strong> if you need to send the report
39 encrypted — ask for it via the contact form and we&apos;ll provide the fingerprint and
40 public key before you send anything sensitive.
41 </p>
42 </Section>
43
44 <Section title="our response targets">
45 <p>once you&apos;ve reported, here is what to expect:</p>
46 <ul className="list-disc pl-5">
47 <li>
48 <strong>acknowledgement</strong> — within one business day (Flanders / EU business
49 hours).
50 </li>
51 <li>
52 <strong>triage + severity assessment</strong> — within five business days, with an
53 initial view on validity and severity.
54 </li>
55 <li>
56 <strong>fix + disclosure</strong> — timeline depends on severity. critical issues are
57 prioritised immediately; we&apos;ll keep you updated and credit you in the changelog
58 (or stay anonymous if you prefer) once a fix ships.
59 </li>
60 </ul>
61 </Section>
62
63 <Section title="responsible disclosure + safe harbour">
64 <p>
65 we will not pursue or support legal action against you for security research conducted
66 in good faith that follows this policy. specifically, if you:
67 </p>
68 <ul className="list-disc pl-5">
69 <li>make a good-faith effort to avoid privacy violations, data destruction, and service degradation;</li>
70 <li>only interact with accounts you own or have explicit permission to test;</li>
71 <li>do not exfiltrate, retain, or share more data than is necessary to demonstrate the issue;</li>
72 <li>give us a reasonable window to remediate before any public disclosure;</li>
73 </ul>
74 <p>
75 then we consider your research authorised, we won&apos;t treat it as a violation of our
76 terms of service, and we&apos;ll work with you to understand and resolve the issue
77 quickly. if a third party brings action against you for activity that complied with this
78 policy, we&apos;ll make it known that your actions were authorised.
79 </p>
80 </Section>
81
82 <Section title="scope">
83 <p>
84 <strong>in scope:</strong>
85 </p>
86 <ul className="list-disc pl-5">
87 <li>
88 <code>briven.tech</code> — the dashboard + marketing site
89 </li>
90 <li>
91 <code>api.briven.tech</code> — the control-plane and HTTP api
92 </li>
93 <li>
94 the open-core repository at{' '}
95 <Link
96 href="https://github.com/flndrn-dev/briven"
97 className="text-[var(--color-text-link)] underline-offset-2 hover:underline"
98 >
99 github.com/flndrn-dev/briven
100 </Link>{' '}
101 and the published <code>@briven/*</code> npm packages
102 </li>
103 </ul>
104 <p>
105 <strong>out of scope</strong> (a non-exhaustive list — please use judgement):
106 </p>
107 <ul className="list-disc pl-5">
108 <li>findings that require physical access to a user&apos;s device, or a compromised device / browser</li>
109 <li>social engineering, phishing, or attacks against briven staff or infrastructure providers</li>
110 <li>volumetric denial-of-service (DoS/DDoS) and brute-force / rate-limit testing against production</li>
111 <li>missing security headers or best-practice nits with no demonstrated exploit</li>
112 <li>reports from automated scanners with no validated, reproducible impact</li>
113 <li>
114 issues in third-party services we depend on (Polar, Cloudflare, Mittera, the hosting
115 provider) — report those to the vendor; tell us if it affects briven users
116 </li>
117 <li>vulnerabilities in your own self-hosted deployment caused by your own configuration</li>
118 </ul>
119 </Section>
120
121 <Section title="supported versions">
122 <p>
123 the hosted platform at <code>briven.tech</code> always runs the latest build — there is
124 only ever one production version, and security fixes ship to it directly. you can
125 confirm the live build sha in the dashboard footer or via{' '}
126 <code>GET https://api.briven.tech/info</code>.
127 </p>
128 <p>
129 for self-hosters, security fixes land on the <code>main</code> branch of the open-core
130 repo and in the latest published <code>@briven/*</code> packages. we support the latest
131 release line only — keep your deployment current to receive fixes. older pinned versions
132 do not receive backported patches.
133 </p>
134 </Section>
135
136 <Section title="related">
137 <p>
138 see also the{' '}
139 <Link
140 href="/sla"
141 className="text-[var(--color-text-link)] underline-offset-2 hover:underline"
142 >
143 service level agreement
144 </Link>{' '}
145 for uptime commitments and the{' '}
146 <Link
147 href="/support"
148 className="text-[var(--color-text-link)] underline-offset-2 hover:underline"
149 >
150 support
151 </Link>{' '}
152 page for non-security help.
153 </p>
154 </Section>
155
156 <p className="mt-12 font-mono text-xs text-[var(--color-text-subtle)]">
157 flndrn Limited, Limassol, Cyprus · thank you for helping keep briven and its users safe.
158 </p>
159 </DocsShell>
160 );
161}
162
163function Section({ title, children }: { title: string; children: React.ReactNode }) {
164 return (
165 <section className="mt-10 flex flex-col gap-3 font-mono text-sm text-[var(--color-text-muted)]">
166 <h2 className="font-mono text-lg tracking-tight text-[var(--color-text)]">{title}</h2>
167 {children}
168 </section>
169 );
170}