Responsible disclosure policy

Version history

1 September 2026: removed the designation of a data protection officer, replaced by a data protection contact.
29 August 2026: introduced the mandatory prior authorization requirement for all testing (section 5.1). Testing carried out before that date falls under the 4 June 2026 version.
4 June 2026: initial version.

1. Introduction

The security of the Brake Point platform, and of the telemetry data entrusted to it, is a priority. This policy describes how to report a vulnerability responsibly, what we commit to in return, and credits the researchers who have contributed to improving our security.

It applies to the following surfaces:

www.brakepoint.io (public marketing site)
app.brakepoint.io (web application)
api.brakepoint.io (REST API)
Brake Point iOS and Android applications

2. How to report a vulnerability

Before any testing, read section 5.1: all testing against our systems, automated or manual, requires prior written authorization. Reporting something you simply noticed requires none.

Send an email to security@brakepoint.io with the following:

Description of the vulnerability (type, OWASP class if relevant)
URL or endpoint affected
Reproduction steps (proof of concept, curl commands, screenshots)
Estimated impact (read/write, data accessible, authentication prerequisites)
Your contact info (name or pseudonym to credit, if applicable)

An RFC 9116 compliant /.well-known/security.txt file is also available.

3. Our commitments

Acknowledgement within 3 business days
Assessment and triage within 10 business days
Fix deployed within a window aligned with severity:
- Critical / High: 30 days
- Medium: 60 days
- Low: 90 days
Public credit on this page after the fix ships (anonymous credit available on request)
No legal action against researchers who follow this policy

4. Scope

4.1 In-scope

Authentication, session, or access control vulnerabilities
Injections (SQL, NoSQL, command, template)
Cross-Site Scripting (XSS) with demonstrated JavaScript execution
Cross-Site Request Forgery (CSRF) on sensitive actions (password change, account deletion, billing changes)
Server-Side Request Forgery (SSRF), Local/Remote File Inclusion (LFI/RFI)
Insecure Direct Object References (IDOR) allowing access to another user's data
Exposure of secrets, API keys, or credentials
Privilege escalation (PILOT → TRAINER → ADMIN)
Bypass of Stripe payment flow or quota limits

4.2 Out-of-scope

Missing HTTP headers without a demonstrated exploit (CSP, HSTS, X-Frame-Options on their own: useful, but logged for internal hardening)
Self-XSS, clickjacking on public pages without a sensitive action
User enumeration on signup / login endpoints by design (BetterAuth returns the same status)
CSRF on non-sensitive actions (language toggle, logout)
Open redirects with no demonstrated impact
Email spoofing against subdomains with no MX
Vulnerabilities requiring physical access or compromise of the user's device
Denial of service (DoS, DDoS) attacks: do not attempt
Vulnerabilities in third-party dependencies with no demonstrated exploit on our infrastructure
Findings from automated scans without manual validation
Vulnerabilities already identified internally or already reported by a third party (duplicates)
Send abuse of email, SMS or notifications: inbox flooding, exhausting a sending quota, repeatedly triggering a code send. This counts as denial of service and must not be attempted

5. Rules of engagement

5.1 Prior authorization is required

Any testing activity against Brake Point systems requires prior written authorization, whether automated or manual. This covers authentication testing, access-control testing, rate-limit testing, the use of scanners, intercepting proxies or fuzzing tools, and the creation of any account intended for testing.

To request authorization, write to security@brakepoint.io stating:

your identity and contact details
the intended scope (domains, endpoints, features)
the methods and tools you plan to use
your preferred testing window
the source IP addresses you will operate from

We respond within 5 business days. Authorization is granted in writing; it is personal, time-limited, restricted to the agreed scope, and revocable at any time.

Reporting is not testing. Reporting something you noticed during normal use of the service, without interacting with it to probe its security, requires no authorization and is welcome at any time at security@brakepoint.io.

Testing carried out without prior authorization falls outside this policy: it carries none of the commitments in section 3, including the commitment not to pursue researchers, and anything found is not eligible for the recognition in section 6.

5.2 Conditions attached to a granted authorization

Under a granted authorization, researchers commit to:

Not disrupting the service nor degrading the experience of other users
Not accessing, modifying or deleting data that doesn't belong to you; use the test accounts agreed in the authorization
Not practicing social engineering against our employees, contractors or users
Not testing against Stripe, Brevo or Scaleway infrastructure beyond Brake Point's public endpoints
Not publicly disclosing the vulnerability before the fix ships (coordination required, 90 days default)
Staying within the scope, window and volume set by the authorization; absent an agreed volume, not exceeding 5 requests per second sustained
Reporting any accounts created for testing purposes, so that we can delete them

6. Rewards

Brake Point does not currently run a paid bug bounty program. We offer:

Public credit on this page (with link and vulnerability category)
Named acknowledgement in the fix commit and CHANGELOG
Brake Point swag (stickers, t-shirt) for notable contributions, on request, while supplies last
For exceptional contributions: extended free access to the Pro plan

Not eligible for public credit or the recognition above:

reports covering a vulnerability already identified internally before the report was received, or already reported by a third party
reports that are out of scope (section 4.2)
findings from testing carried out without prior authorization (section 5.1)
reports whose impact is not demonstrated

Eligibility is assessed by Brake Point. A report that is not eligible is still triaged and fixed within the timelines in section 3 where it is valid; only the recognition is withheld.

This policy may evolve into a paid program after the official launch (end of November 2026).

7. Acknowledgements

We publicly thank the following researchers for contributing to Brake Point's security:

Researcher	Vulnerability	Reported	Fixed
rae050	Privilege escalation	7 August 2026	10 August 2026

8. Contact

Vulnerability reports: security@brakepoint.io

Data protection contact: privacy@brakepoint.io

Postal address:

Ethan Consulting
10 allées des boutons d'or
78180 Montigny-le-Bretonneux
France