konnossecurity.txt29 lines · main
| 1 | # briven security disclosure policy |
| 2 | # RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116 |
| 3 | |
| 4 | Contact: mailto:security@flndrn.com |
| 5 | Expires: 2027-05-21T00:00:00.000Z |
| 6 | Preferred-Languages: en, nl, fr |
| 7 | Canonical: https://briven.tech/.well-known/security.txt |
| 8 | Policy: https://docs.briven.tech/trust |
| 9 | Acknowledgments: https://docs.briven.tech/trust#acknowledgments |
| 10 | |
| 11 | # We commit to: |
| 12 | # 1. acknowledging valid reports within 72 hours. |
| 13 | # 2. patching critical vulnerabilities within 14 days of triage. |
| 14 | # 3. publicly crediting researchers (opt-in) on docs.briven.tech/trust. |
| 15 | # |
| 16 | # In scope: briven.tech (managed platform), docs.briven.tech, api.briven.tech, |
| 17 | # realtime.briven.tech, the briven-core open-source codebase |
| 18 | # at code.konnos.org/flndrn/briven. |
| 19 | # |
| 20 | # Out of scope: third-party services we use (Polar, Mittera, Hostinger, |
| 21 | # Cloudflare) — report those to the respective vendor. |
| 22 | # Social-engineering attacks against staff or customers. |
| 23 | # Physical-security tests of any briven-operated facility. |
| 24 | # |
| 25 | # Please do NOT: |
| 26 | # - exfiltrate or modify other customers' data |
| 27 | # - run automated scanners that meaningfully impact availability |
| 28 | # - publicly disclose before we've had a chance to patch (14 days |
| 29 | # for criticals, 90 days otherwise) |