Vulnerability Disclosure Policy

1. How to report

Email contact@brandreco.com with the subject "Security report". Please include:

• the page, endpoint or feature affected;
• the steps to reproduce it, and a proof of concept if you have one;
• what an attacker could do with it — the impact, as you understand it;
• how you would like to be credited, if at all.

One report per issue is easiest for us to track. Write in English or Bulgarian. There is no bug bounty: we don't pay for reports, but we are grateful for them and will credit you in our changelog if you want us to.

2. What is in scope

• brandreco.com — the public site, the app under /app, the API under /api, /auth and /public;
• the MCP server and its OAuth endpoints (/mcp, /oauth and /.well-known/oauth-*);
• the free check and our analysis bot, BrandRecoBot — including whether they can be made to reach hosts they shouldn't (SSRF). Point them only at hosts you control;
• the emails we send, where the problem is in our links or tokens.

3. What is out of scope

• services we use but don't run — Stripe, Google, the AI providers, Hetzner and others. Report those to them;
• denial of service, load or stress testing, and anything that degrades the service for other people;
• social engineering or phishing of our team or our customers, and physical attacks;
• sending email to addresses that aren't yours — including by signing others up;
• reports from automated scanners without a working proof of concept;
• missing security headers, email-authentication records or other best-practice settings, without a demonstrated impact;
• clickjacking on pages with no sensitive action, self-XSS, logout CSRF, and software-version disclosure;
• problems that need a compromised device, a rooted browser or an outdated browser to exploit.

4. Rules for testing

• Use only accounts you created yourself, with email addresses you control. Unconfirmed accounts are deleted after 30 days, so confirm the ones you need.
• Don't access, change or delete other people's data. If you reach any by accident, stop, don't keep or share it, and tell us in your report.
• Do the minimum needed to show the problem exists. Don't pivot further into our systems once you have.
• Keep automated testing gentle — a few requests a second at most — and stop if you notice the service slowing down.
• Don't use the free check or BrandRecoBot against websites you don't own.
• Keep the details confidential until we have fixed the problem, or until 90 days after your report, whichever comes first — and tell us before you publish.

5. What we do

• acknowledge your report within 3 business days;
• tell you within 10 business days whether we can reproduce it and how serious we think it is;
• keep you informed while we fix it, and tell you when it is fixed;
• credit you, if you want, once it is fixed.

6. Safe harbour

If you research and report in good faith and within this policy, we consider your research authorised under our Terms of Service. We will not bring legal action against you or ask the authorities to, and if someone else does over research that followed this policy, we will make it known that it was authorised by us.