BraboOpen Brabo

Vulnerability Disclosure Policy

Last updated: 20 October 2026

Brabo Group Ltd ("we", "us") runs Brabo. We welcome reports from security researchers and anyone else who finds a weakness in it. If you believe you have found a vulnerability, a privacy issue, exposed data, or any other security problem in Brabo, we want to hear from you. This policy explains how to report it, what we ask of you, and what you can expect from us.

This policy is based on the open-source disclose.io vulnerability disclosure terms.

How to report

Email owlbert@brabo.team with "Security report" in the subject. This is the only official channel for security reports. Please include:

  • What the problem is, and where (the page, app screen or API address)
  • Steps to reproduce it, with any proof-of-concept code, requests or screenshots
  • What an attacker could do with it, as you understand it
  • How you would like to be credited, if at all

You can write to us in English. Please don't report security problems through Brabo's chat, public posts or social media.

What's in scope

This policy covers systems that we own and operate for Brabo:

  • brabo.team and its subdomains that we run, including the admin area
  • trialportal.org and its subdomains that we run, which serve older versions of the apps
  • The Brabo API those sites and apps use
  • The Brabo apps for iOS, Android, Windows and macOS

What's out of scope

The following are not covered, and you must not test them under this policy:

  • Services run by other companies that Brabo uses, such as our identity-verification, hosting, content-delivery, email and push-notification providers, and Emerald Chat. Report problems in those to the company concerned.
  • Denial-of-service attacks, load testing, or anything that degrades the service for others
  • Social engineering, phishing, or any attempt to deceive our staff, recruits or moderators
  • Physical attacks on people, offices or equipment
  • Spam, or automated scanning at a volume that affects other people's use of Brabo

We are also unlikely to act on reports like these unless you show a real impact:

  • Missing security headers or cookie flags without a working exploit
  • Clickjacking on pages that have no sensitive actions
  • Email configuration findings (SPF, DKIM, DMARC) on their own
  • Self-XSS, or attacks that need the victim to paste code into their own browser
  • Rate-limiting on actions that are not sensitive
  • Software version numbers or banners with no exploitable weakness
  • Problems that only affect outdated browsers or operating systems

Our commitments

When you report a vulnerability under this policy, we will:

  • Acknowledge your report within 5 working days
  • Work with you to understand and confirm it, and tell you whether we consider it valid
  • Keep you informed while we fix it
  • Fix confirmed vulnerabilities as quickly as we reasonably can, within our operational limits
  • Credit you on this page once it's fixed, if you would like that
  • Extend the safe harbour below to research that follows this policy

Rewards

Brabo is run by a very small team, and we can't offer money or prizes for reports. What we can offer is a prompt, honest response, credit on this page if you want it, and our real thanks.

What we ask of you

To take part in good faith, please:

  • Follow this policy. Where it conflicts with other terms that apply to you, this policy prevails for your research.
  • Report what you find promptly, and only through the official channel above.
  • Respect other people's privacy and the service. Don't disrupt Brabo, destroy or change data, or harm anyone's experience of it.
  • Use only accounts you own, or accounts whose owner has explicitly agreed. Brabo's accounts are verified and invitation-only, so if you need a test account, ask us for one first.
  • If a vulnerability gives you access to data that isn't yours, access only the minimum needed to show the problem. Stop and report it straight away if you come across anyone's personal data, such as messages, identity information or account details. Don't copy, keep or share it, and delete anything you saved once you've reported it.
  • Don't use a vulnerability to keep access, move to other systems, or go further than needed to show it exists.
  • Give us reasonable time to fix the problem before you disclose it publicly (see below).
  • Don't demand payment or make threats. Extortion is not good-faith research, and this policy does not cover it.

Public disclosure

We ask that you keep the details private until the problem is fixed, or for 90 days after your report, whichever comes first, and that you let us know before you publish. If a fix needs longer, we'll explain why and agree a new date with you. We may publish our own summary of fixed vulnerabilities, crediting you if you agree.

Safe harbour

When you conduct security research in line with this policy, we consider it:

  • Authorised with respect to applicable anti-hacking laws, and we will not start or support legal action against you for accidental, good-faith breaches of this policy
  • Authorised with respect to applicable anti-circumvention laws, and we will not bring a claim against you for circumventing technical controls
  • Exempt from the parts of our Terms of Service that would otherwise prevent the research, which we waive for that limited purpose
  • Lawful, helpful to the overall security of the internet, and carried out in good faith

You must still comply with all applicable laws. If a third party starts legal action against you and you followed this policy, we will make it known that your research was carried out under it.

The safe harbour covers only claims within our control. It does not bind other parties, including the providers listed as out of scope, and it does not cover testing of their systems.

If you're ever unsure whether something you want to do fits this policy, ask us at owlbert@brabo.team before going further.

If you act in good faith and follow this policy, we consider your research authorised. We will not take legal action against you or ask anyone else to, including under the Computer Misuse Act 1990, and if someone else takes action over research you did under this policy, we will make it known that it was authorised. This does not cover anything outside this policy, such as accessing other people's data beyond what is needed to show the problem, or harming Brabo or its users.

Thanks

People who have responsibly reported security problems in Brabo:

Nobody yet. Your name could be the first here.

Other requests

This page is for security reports only. For help with your account, see Support. Requests from police, courts and other authorities are covered by our Law enforcement policy. A machine-readable version of our security contact is at /.well-known/security.txt.