Security
Vulnerability disclosure
We take security seriously and welcome reports from researchers, customers, and the wider community. This page describes how to reach us, what we commit to, and what behavior is in scope.
How to report
Email security@withbruner.com. Include enough detail for us to reproduce: an HTTP request log, a minimal proof-of-concept, and any prerequisites (account, browser, environment). Encrypted reports are welcome — request our PGP key in your first message.
What we commit to
- Acknowledge receipt within 3 business days.
- Provide a triage outcome (in scope / out of scope / duplicate / not a security issue) within 10 business days.
- Coordinate disclosure timing with you in good faith. We aim for fixes within 90 days for high-severity issues; we'll tell you if we need longer and why.
- Credit you publicly in our security acknowledgements (with your permission).
- Not pursue legal action for good-faith research that follows this policy.
In scope
- withbruner.com and its subdomains, plus the Bruner mobile and web apps once available.
- Authentication, authorization, data exposure (yours or another user's), billing or credit accounting bugs, and prompt-injection or pipeline-leak vectors that exfiltrate internal prompts or model behavior.
Out of scope
- Denial-of-service, volumetric attacks, or any test that degrades service for other users.
- Social engineering of Bruner staff, customers, or our third-party service providers (for example, our hosting, email, or infrastructure vendors).
- Issues in third-party services that don't materially affect Bruner data.
- Missing security headers, weak ciphers, or other automated-scan findings without a concrete impact path.
- Spam, phishing, or content abuse — those go to abuse@withbruner.com instead.
Rules of engagement
- Use only your own accounts for testing.
- Do not access, modify, or destroy data that doesn't belong to you. Stop and report as soon as you can prove an impact path.
- Don't publicly disclose without giving us a reasonable window to fix (typically 90 days, sooner by mutual agreement for low-impact issues).
- Do not run automated scanners against production beyond what a normal user would generate. If you need a higher rate to reproduce, ask first.
This policy is a living document — last revised . Material changes will be announced on this page with an effective date.