Reporting a vulnerability

How to report

Email info@breachrr.com with a description of the issue, reproduction steps, and any proof-of-concept material. If the vulnerability is sensitive, you can request a PGP key in your first message and we’ll send one back before you share the technical details.

You don’t need a Breachrr account to report a vulnerability. You don’t need to be a security professional. If it looks wrong to you, tell us.

Response times

• Acknowledgement: within 72 hours of receipt. A human replies confirming we’ve seen your report.
• Triage: within 7 days. We’ll tell you whether we’ve reproduced it, our current severity assessment, and an initial timeline.
• Resolution target: 90 days for confirmed vulnerabilities, faster for anything high-severity. If a fix is going to take longer, we’ll say so and explain why.

Safe harbour

If you make a good-faith effort to comply with this policy during your research, we will:

• Not pursue or support legal action against you.
• Work with you to understand and resolve the issue quickly, and credit you publicly if you’d like.
• Consider your research authorised under the Computer Misuse Act (UK) and equivalent statutes elsewhere.

Good-faith means: no accessing data that isn’t yours, no denial-of-service, no social engineering of our staff or customers, no physical attacks, no automated scanning that degrades our service for other users.

In scope

• The Breachrr web application at breachrr.com
• The Breachrr API at api.breachrr.com (once deployed)
• The public marketing site and blog
• Emails sent from @breachrr.com addresses
• DNS, SPF, DKIM, and DMARC records for breachrr.com

Out of scope

• Third-party infrastructure we depend on (Supabase, Railway, Vercel, Paystack, Resend). Please report those to the vendor.
• Rate-limit bypass without a demonstrated impact beyond the rate limit itself.
• Findings from automated scanners without a working proof-of-concept.
• Missing security headers or cookie flags without a demonstrated impact.
• Social engineering, phishing, or physical security attacks against Breachrr staff or contractors.
• Denial-of-service or resource-exhaustion attacks.

Rewards

Breachrr is a solo-founded early-stage company, and we don’t currently run a paid bug bounty. We do offer public acknowledgement (if you want it), a formal thank-you, and lifetime credit on the Breachrr platform for confirmed vulnerabilities of medium or higher severity. We’ll consider paid rewards once we have the revenue to back it up.

Machine-readable policy

This policy is also available at /.well-known/security.txt per RFC 9116.