Responsible Disclosure
If you believe you have found a security vulnerability in our website, please tell us. This page explains how to report it responsibly.
Clarify what needs to change—and why it matters.
We confirm these points with your stakeholders, data and dependencies before recommending a route.
Customer problem
- Buyers, partners and candidates need verified company information before engaging.
- Generic company claims can obscure what is evidenced, governed or still subject to review.
- Contact, privacy and trust routes must match the controls that operate behind the website.
Business impact and decision
- Make approved company, trust and contact information easier to evaluate.
- Route each audience to the right governed information or inquiry path.
- Keep legal, security, location and employment claims behind their required approvals.
Move from context to an accountable delivery route.
How we move from your operating context to a clear, accountable delivery plan.
Scope
This policy covers the Bright Brains website at brightbrainsit.com. Issues in third-party products we work with should be reported to the vendor concerned.
In and Out of Scope
In scope: vulnerabilities in our website that could affect its confidentiality, integrity or availability. Out of scope: denial-of-service testing, social engineering, physical attacks, and automated scanner output without a demonstrated issue.
Testing Rules
Test only against your own accounts or data, do not access or change other people’s information, do not degrade the service, and stop as soon as you have confirmed an issue.
How to Report
Send your report through our contact page and mention security in the inquiry topic. Please keep sensitive details out of the first message; we can agree a secure way to share them.
Required Details
A useful report includes the affected address, a description of the issue, the steps to reproduce it, its potential impact and how we can contact you.
Good-Faith Research
We value good-faith research that follows these guidelines and gives us reasonable time to fix an issue before anything is made public.
Confidentiality
Please keep the details of a reported issue confidential until it has been fixed. We treat your report and your contact details as confidential.
This policy may be updated as our processes evolve. The current version is always on this page.
Continue with the evidence and service route.
Found a potential vulnerability?
Report it through our contact page, following the guidelines above.