Security & Vulnerability Reporting

1. How to report

Use the contact form, select “Another workflow,” begin the message with “SECURITY REPORT,” and include the affected URL, a concise impact description, and minimal reproduction steps. Do not send credentials, personal data, destructive payloads, or data taken from another user. A dedicated verified security email has not been supplied.

2. Good-faith research

• Test only Brainfish AI-operated website surfaces you are authorized to access.
• Stop after collecting the minimum evidence needed to explain the issue.
• Do not access, alter, retain, or disclose other people’s data.
• Do not perform denial-of-service, social engineering, spam, physical testing, or high-volume automated scanning.
• Allow a reasonable opportunity to investigate before public disclosure.

3. Current scope

This marketing site and its form endpoint are in scope. Customer environments, third-party systems, the user’s domain registrar, Cloudflare infrastructure, OpenAI systems, and any future product pilot are not automatically in scope. Report third-party vulnerabilities to the relevant provider.

4. Current implementation boundaries

Submissions are validated server-side and stored in a private D1 binding. There is no public endpoint to list submissions, no file upload, no account system, and no payment flow. These statements describe implementation structure, not a penetration-test result or certification.

5. Future pilots

A future product pilot should separately document environment isolation, connected credentials, role permissions, action controls, logging, incident handling, data retention, and responsible testing authorization before operational access begins.